joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e0a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
jl 0x100e0c07
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x100e0a50
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x100e0c07
push eax
call sym.ExuiKrnln_X32.dll_DeleteTimerEx
mov dword [esi + 0x1a8], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [esi + 0x198]
movzx ecx, ax
test eax, eax
jne 0x100e0aff
mov edi, dword [esi + 0x1a8]
test edi, edi
je 0x100e0ad9
cmp byte [edi + 0x10], al
jne 0x100e0acf
cmp dword [edi + 4], edi
jne 0x100e0acf
mov ebx, dword [edi + 8]
mov byte [edi + 0x10], 1
mov dword [edi + 4], eax
mov dword [edi + 8], eax
test ebx, ebx
je 0x100e0aa3
push 0xea60
push 0xea60
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call eax
push 0
push 0
push edi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1a8], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x1a4], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [esi + 0x1a4]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x1a4], eax
cmp eax, 0xfe
jle 0x100e0bc3
mov edi, dword [esi + 0x1a8]
mov dword [esi + 0x1a4], 0xff
test edi, edi
je 0x100e0ba7
cmp byte [edi + 0x10], 0
jne 0x100e0b9d
cmp dword [edi + 4], edi
jne 0x100e0b9d
mov ebx, dword [edi + 8]
mov byte [edi + 0x10], 1
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test ebx, ebx
je 0x100e0b71
push 0xea60
push 0xea60
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call eax
push 0
push 0
push edi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1a8], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x1a8], 0
jne 0x100e0c07
movsx eax, word [esi + 0x19a]
mov ecx, 0x21
push 0
push 0
test eax, eax
push esi
cmove eax, ecx
push fcn.100e0a10
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x1a8], eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x100e46e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xd
push eax
mov eax, dword [ebp + 8]
push eax
push 0x3fa
mov dword [ebp - 4], 0
push dword [eax + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esp, ebp
pop ebp
ret 4
Function at 0x100fe3d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100fe457
cmp byte [esi + 0x24], 0
jne 0x100fe457
cmp dword [esi + 4], esi
jne 0x100fe457
mov eax, dword [esi + 0x2c]
mov byte [esi + 0x24], 1
mov dword [esi + 4], 0
test eax, eax
je 0x100fe3fb
mov byte [eax], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100fe40f
push eax
mov dword [esi + 0x28], 0
call sym.ExuiKrnln_X32.dll_DeleteTimerEx
push dword [esi + 0x14]
mov eax, dword [esi + 0x20]
push 0
push 0
push dword [esi + 0x18]
push 0xfffffffffffffffe
push esi
call eax
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100fe438
push eax
call fcn.1013a201
add esp, 4
mov dword [esi + 0x1c], 0
push 0
push 0
push esi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 4
Function at 0x101029e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
jl 0x10102bd7
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 1
jge 0x10102a20
mov eax, dword [esi + 0x1c8]
test eax, eax
je 0x10102bd7
push eax
call sym.ExuiKrnln_X32.dll_DeleteTimerEx
mov dword [esi + 0x1c8], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [esi + 0x1b8]
movzx ecx, ax
test eax, eax
jne 0x10102acf
mov edi, dword [esi + 0x1c8]
test edi, edi
je 0x10102aa9
cmp byte [edi + 0x10], al
jne 0x10102a9f
cmp dword [edi + 4], edi
jne 0x10102a9f
mov ebx, dword [edi + 8]
mov byte [edi + 0x10], 1
mov dword [edi + 4], eax
mov dword [edi + 8], eax
test ebx, ebx
je 0x10102a73
push 0xea60
push 0xea60
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call eax
push 0
push 0
push edi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c8], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x1c4], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [esi + 0x1c4]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x1c4], eax
cmp eax, 0xfe
jle 0x10102b93
mov edi, dword [esi + 0x1c8]
mov dword [esi + 0x1c4], 0xff
test edi, edi
je 0x10102b77
cmp byte [edi + 0x10], 0
jne 0x10102b6d
cmp dword [edi + 4], edi
jne 0x10102b6d
mov ebx, dword [edi + 8]
mov byte [edi + 0x10], 1
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test ebx, ebx
je 0x10102b41
push 0xea60
push 0xea60
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call eax
push 0
push 0
push edi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c8], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x1c8], 0
jne 0x10102bd7
movsx eax, word [esi + 0x1ba]
mov ecx, 0x21
push 0
push 0
test eax, eax
push esi
cmove eax, ecx
push fcn.101029e0
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x1c8], eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x1010ec60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1010ecdf
cmp byte [esi + 0x10], 0
jne 0x1010ecdf
cmp dword [esi + 4], esi
jne 0x1010ecdf
push edi
mov edi, dword [esi + 8]
mov byte [esi + 0x10], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test edi, edi
je 0x1010ecae
push 0xea60
push 0xea60
push edi
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call eax
push 0
push 0
push esi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 4
Function at 0x10127030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x10185a90], 0
push esi
push edi
mov esi, ecx
jne 0x10127119
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, str.C:ExuiKrnln_win32.ini
push ebx
push 0
push 0
push 3
push 0
push 1
test esi, esi
mov eax, str.C:ExuiKrnln_win64.ini
push Ordinal_1
cmove eax, ecx
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1012709d
push 0
push 0
push 3
push 0
push 1
mov ecx, str.D:ExuiKrnln_win32.ini
test esi, esi
mov eax, str.D:ExuiKrnln_win64.ini
push Ordinal_1
cmove eax, ecx
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10127118
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push 0x104
push 0x10185a90
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10127111
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x10127130
xor ecx, ecx
mov word [eax + 0x10185a90], cx
mov ecx, 0x10185a90
call fcn.100ffe00
mov esi, eax
mov ecx, 0x82
mov edi, 0x10185a90
mov eax, 0x206
rep movsd dword es:[edi], dword [esi]
cmp word [eax + 0x10185a90], 0x5c
je 0x10127111
cmp eax, 0x208
jae 0x10127130
xor ecx, ecx
mov word [eax + 0x10185a90], cx
sub eax, 2
jns 0x101270f2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, 0x82
mov esi, 0x10185a90
mov edi, 0x10185c98
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1013a36f
int3
Function at 0x1012ef20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
cmp edi, 1
jge 0x1012ef3e
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4
push esi
lea esi, [edi*2 + 4]
push esi
call fcn.1013a244
push esi
push 0
push eax
mov dword [ebp + 8], eax
call fcn.1013bf60
add esp, 0x10
lea ecx, [edi + 1]
push ecx
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax*2 + 2]
cmp edi, 3
jge 0x1012ef8a
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [edi + 8]
push eax
call fcn.1013a244
mov esi, eax
push edi
push ebx
lea eax, [esi + 8]
push eax
call fcn.1013d3f0
add esp, 0x10
mov dword [esi + 4], edi
mov dword [esi], 0xffffffff
push esi
sub esp, 8
call fcn.100fee60
add esp, 0xc
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10132c10
Capabilities:
Get graphical window text

Disassembly:
cmp edx, 0x40
jg 0x10132d1e
je 0x10132cfd
dec edx
cmp edx, 0x1f
ja case.0x10132c30.3
movzx eax, byte [edx + 0x10132e00]
jmp dword [eax*4 + 0x10132de4]
cmp dword [ecx + 0x6c], 0xf
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0xf
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0x11
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0x11
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0x13
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0x13
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0x12
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0x12
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0x10
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0x10
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0x14
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0x14
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0x15
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0x15
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp edx, 0x400
jg 0x10132d97
je 0x10132d7a
cmp edx, 0x80
je 0x10132d5d
cmp edx, 0x200
jne case.0x10132c30.3
cmp dword [ecx + 0x6c], 0xd
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0xd
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0x16
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0x16
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 0
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 0
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp edx, 0x800
je 0x10132dc4
cmp edx, 0x1000
jne case.0x10132c30.3
cmp dword [ecx + 0x6c], 6
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 6
call dword [sym.imp.USER32.dll_SendMessageW]
ret
cmp dword [ecx + 0x6c], 3
je case.0x10132c30.3
push 0
push 0
push 0x20
push dword [ecx + 0x28]
mov dword [ecx + 0x6c], 3
call dword [sym.imp.USER32.dll_SendMessageW]
ret
Function at 0x10139ff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
jl 0x1013a1eb
cmp dword [esi + 0x2c], 0xffffffff
jge 0x1013a03a
mov eax, dword [esi + 0x18c]
mov dword [esi + 0x188], 0
test eax, eax
je 0x1013a1eb
push eax
call sym.ExuiKrnln_X32.dll_DeleteTimerEx
mov dword [esi + 0x18c], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [esi + 0x184]
lea edi, [esi + 0x18c]
cmp dword [eax + 0xc], 0
jg 0x1013a051
mov dword [ebp + 0x1c], edi
jmp 0x1013a062
mov eax, dword [eax + 0x10]
mov ebx, edi
mov dword [ebp + 0x1c], ebx
cmp dword [eax], 0
jne 0x1013a0f2
mov edi, dword [edi]
mov dword [esi + 0x188], 0
test edi, edi
je 0x1013a18f
cmp byte [edi + 0x10], 0
jne 0x1013a0e4
cmp dword [edi + 4], edi
jne 0x1013a0e4
mov ebx, dword [edi + 8]
mov byte [edi + 0x10], 1
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test ebx, ebx
je 0x1013a0b8
push 0xea60
push 0xea60
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call eax
push 0
push 0
push edi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
jmp 0x1013a18f
mov eax, dword [esi + 0x188]
inc eax
mov dword [esi + 0x188], eax
cmp eax, 4
jle 0x1013a1ab
mov edi, dword [edi]
mov dword [esi + 0x188], 0
test edi, edi
je 0x1013a18f
cmp byte [edi + 0x10], 0
jne 0x1013a189
cmp dword [edi + 4], edi
jne 0x1013a189
mov ebx, dword [edi + 8]
mov byte [edi + 0x10], 1
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test ebx, ebx
je 0x1013a15a
push 0xea60
push 0xea60
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call eax
push 0
push 0
push edi
push 0x10102c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [edi], 0
jne 0x1013a1eb
mov eax, dword [esi + 0x184]
cmp dword [eax + 0xc], 0
jg 0x1013a1d4
xor eax, eax
jmp 0x1013a1d9
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
push 0
push 0
push esi
push fcn.10139ff0
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18

Function at 0x101514c3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10151342
Function at 0x1015258b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1015224b

Function at 0x10159910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1015993d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1015993d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40703a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x407084
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x407053
jmp 0x407084
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x407074
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x407c16
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x407c4b
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x407c75
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x407c75
test edi, edi
je 0x407c42
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x407c42
test edi, edi
je 0x407c7d
mov eax, edi
jmp 0x407c44
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x407c44
int3
Function at 0x40ad20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestMacroArgs.exe_gMozillaPoisonSize], eax
call fcn.00407c16
pop ecx
mov ecx, dword [sym.TestMacroArgs.exe_gMozillaPoisonSize]
mov dword [sym.TestMacroArgs.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40ad58
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMacroArgs.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10001022
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 1
je 0x100010c4
call fcn.100010e4
xor ebp, ebp
mov dword [esi], eax
cmp eax, ebp
jne 0x10001054
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
jne 0x100010e0
push 0x7e
pop eax
jmp 0x100010e0
push ebx
lea ebx, [esi + 8]
push 0x14
push ebp
push ebx
call fcn.10031550
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
push 0x200f
push dword [esi]
call edi
push 0x2010
mov dword [ebx], eax
push dword [esi]
call edi
push 0x2011
mov dword [esi + 0xc], eax
push dword [esi]
call edi
push 0x2016
mov dword [esi + 0x10], eax
push dword [esi]
call edi
push 0x2015
mov dword [esi + 0x14], eax
push dword [esi]
call edi
cmp dword [ebx], ebp
mov dword [esi + 0x18], eax
pop ebx
je 0x100010c8
cmp dword [esi + 0xc], ebp
je 0x100010c8
cmp dword [esi + 0x10], ebp
je 0x100010c8
cmp dword [esi + 0x14], ebp
je 0x100010c8
cmp eax, ebp
je 0x100010c8
mov dword [esi + 4], 1
xor eax, eax
jmp 0x100010e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebp
jne 0x100010d7
push 0x7f
pop edi
mov ecx, esi
call fcn.10001187
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x10002fbc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x10002fe1
push 1
pop eax
jmp 0x10003076
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
mov dword [ebp - 4], eax
je 0x10002ff4
cmp eax, 2
jne 0x1000306b
push esi
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp - 0x108], bl
je 0x1000303b
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x108]
push eax
call esi
cmp byte [ebp + eax - 0x109], 0x5c
jne 0x1000303b
lea eax, [ebp - 0x108]
push eax
call esi
mov byte [ebp + eax - 0x109], bl
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.100317c0
pop ecx
cmp eax, ebx
pop ecx
pop esi
je 0x1000306b
mov byte [eax], bl
lea eax, [ebp - 0x108]
push eax
call fcn.10002fbc
test eax, eax
pop ecx
je 0x1000306b
push ebx
push dword [ebp + 8]
call edi
jmp 0x10003076
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebx
leave
ret