joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100829a0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x100829a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100829af
pop dword [ebp - 0x50]
mov eax, 0xbd300493
sub eax, 0xad27dae4
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xee89e17c
sub dword [ebp - 0x60], 0xa0379c31
mov dword [ebp - 0x5c], 0xd33e7000
sub dword [ebp - 0x5c], 0xa10b23bb
mov dword [ebp - 0x58], 0xdfef4d24
add dword [ebp - 0x58], 0x6c5cf70a
mov dword [ebp - 0x54], 0x93fd5fc8
sub dword [ebp - 0x54], 0x93fd5fc8
lea eax, [ebp - 0x60]
push eax
mov eax, 0x9842bb1f
sub eax, 0x88374a3f
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2d376e9e
sub dword [ebp - 0x60], 0xb8c50548
mov dword [ebp - 0x5c], 0x5d174b9c
add dword [ebp - 0x5c], 0xe45515d9
mov dword [ebp - 0x58], 0x93b62dd7
sub dword [ebp - 0x58], 0x3046c16b
mov dword [ebp - 0x54], 0x377d5a3a
sub dword [ebp - 0x54], 0x377d5a3a
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x13d2983d
sub eax, 0x3c727a1
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x5e358
push 0
call eax
mov ecx, 0x19542901
add ecx, 0xe6ac20d8
mov edx, eax
mov edi, 0x911df346
add edi, 0x7ef140ba
add edi, dword [ebp - 0x50]
mov esi, 0xd82a9815
add esi, 0xd2993c2f
xor dword [ebp - 4], edx
mov ebx, dword [edi]
add ebx, esi
mov dword [ebp - 0x38], 0x1ab574
mov dword [edx], ebx
add edx, 0x60eae9de
add edx, 0x9f151626
add edi, 0x7c4c1794
add edi, 0x83b3e870
loop 0x10082ad1
add eax, 0x8efb81f5
add eax, 0x71059842
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x405c8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422aa4], 0
push esi
jne 0x405cc3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c9d
mov dword [ecx*4 + 0x422aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c98
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cf4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405cd6
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40aeb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
jmp 0x40aeca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40aed1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40aec0
mov eax, 1
add ebx, ebx
jne 0x40aee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40aed8
jne 0x40aef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40aed8
xor ecx, ecx
sub eax, 3
jb 0x40af08
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40af7a
mov ebp, eax
add ebx, ebx
jne 0x40af13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40af20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40af44
inc ecx
add ebx, ebx
jne 0x40af30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40af25
jne 0x40af41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40af25
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40af64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40af55
jmp 0x40aec6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40af64
add edi, ecx
jmp 0x40aec6
pop esi
mov edi, esi
mov ecx, 0xca
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40af82
cmp byte [edi], 0
jne 0x40af82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40af87
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40aff6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb2cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40afb4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb2d4]
or eax, eax
je 0x40aff0
mov dword [ebx], eax
add ebx, 4
jmp 0x40afd1
call dword [esi + 0xb2d0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40b027
cmp al, 0xef
ja 0x40b01a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40affc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40b009
mov ebp, dword [esi + 0xb2d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40b05b
sub esp, 0xffffff80
jmp 0x402525

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004a79f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1004a7ae
pop dword [ebp - 0x48]
mov eax, 0x724b3ad3
sub eax, 0x62469325
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x3f44fca
sub dword [ebp - 0x58], 0xb5a20a7f
mov dword [ebp - 0x54], 0xaef47ee9
add dword [ebp - 0x54], 0x833ecd5c
mov dword [ebp - 0x50], 0x3357a4b3
sub dword [ebp - 0x50], 0xe70b6085
mov dword [ebp - 0x4c], 0x18496c5e
sub dword [ebp - 0x4c], 0x18496c5e
lea eax, [ebp - 0x58]
push eax
mov eax, 0xea1f2b25
add eax, 0x25e6d4eb
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb82472a1
sub dword [ebp - 0x58], 0x43b2094b
mov dword [ebp - 0x54], 0x8d07e876
sub dword [ebp - 0x54], 0x4b9b8701
mov dword [ebp - 0x50], 0x17b65daf
add dword [ebp - 0x50], 0x4bb90ebd
mov dword [ebp - 0x4c], 0xac581ea
sub dword [ebp - 0x4c], 0xac581ea
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xf95cf26c
add eax, 0x16a90da8
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x568a9
push 0
call eax
mov ecx, 0xec806ee9
sub ecx, 0xec802408
xor edi, edi
add edi, eax
mov ebx, 0x1008bc00
add ebx, dword [ebp - 0x48]
mov esi, 0xad7680f9
mov edx, dword [ebx]
add dword [ebp - 0x1c], ecx
xor edx, esi
xor dword [ebp - 0x14], 0xafc891b2
mov dword [edi], edx
add dword [ebp - 8], edi
add edi, 4
add ebx, 4
loop 0x1004a8c6
add eax, 0xea32532d
sub eax, 0xea3134d6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5873bc8
add ecx, 0xa78c438
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4021e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x42c
mov eax, dword [0x459444]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x434]
push 0x424
push 0
push eax
call fcn.00425e40
add esp, 0xc
mov dword [ebp - 0x438], 0x428
push dword [ebp + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea ebx, [ebp - 0x438]
push ebx
push eax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x402256
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test ax, ax
je 0x402267
cmp ax, 0x5c
je 0x40224e
mov eax, dword [ebp + 0xc]
cmp word [eax + 2], 0x3a
jne 0x402267
lea edi, [ebp - 0x218]
jmp 0x40227b
push str.CheckLibraryLoaded:_Failed_to_load_module_snapshot
call fcn.00401a40
add esp, 4
xor ebx, ebx
jmp 0x4022a8
lea edi, [ebp - 0x418]
jmp 0x40227b
push ebx
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x402263
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x430], eax
jne 0x402270
push edi
push dword [ebp + 0xc]
call fcn.0042ddb3
add esp, 8
test eax, eax
jne 0x402270
push dword [ebp + 0xc]
push str.CheckLibraryLoaded:_Module__ls_is_already_loaded
call fcn.00401a40
add esp, 8
mov bl, 1
mov eax, esi
add eax, 1
cmp eax, 2
jb 0x4022b9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040adc8
mov eax, ebx
add esp, 0x42c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b08e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42b0cd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42b0cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42b0cd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42b0cd
cmp dword [ecx + 0x74], 0xe
jbe 0x42b0cd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x436aa6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x449ba0
push 0x449b98
push str.FlsAlloc
push 0x1f
call fcn.00436f59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436ada
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x436ae0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x436b24
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x449bb0
push 0x449ba8
push str.FlsGetValue
push 0x21
call fcn.00436f59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436b5b
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x436b63
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x449bb8
push 0x449bb0
push str.FlsSetValue
push 0x22
call fcn.00436f59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436b9d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43b857
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x459444]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0043627a
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0043627a
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x43b8ce
cmp word [ecx], dx
je 0x43b8ce
mov eax, dword [0x44a02c]
push edi
dec eax
push eax
push 0x449f18
call fcn.0043ba47
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x43b941
cmp word [eax], dx
je 0x43b941
mov eax, dword [edi]
test eax, eax
je 0x43b8f2
cmp word [eax], dx
je 0x43b8f2
lea eax, [ebp - 0x10]
push eax
call fcn.0043baa8
jmp 0x43b8fb
lea eax, [ebp - 0x10]
push eax
call fcn.0043bda3
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x43b96b
mov eax, dword [0x449f14]
push dword [ebp - 0x14]
dec eax
push eax
push 0x449c08
call fcn.0043ba47
add esp, 0xc
test al, al
je 0x43b96b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x43b936
cmp word [eax], di
je 0x43b936
lea eax, [ebp - 0x10]
push eax
call fcn.0043baa8
pop ecx
jmp 0x43b96d
lea eax, [ebp - 0x10]
push eax
call fcn.0043bda3
jmp 0x43b933
mov eax, dword [edi]
test eax, eax
je 0x43b958
cmp word [eax], dx
je 0x43b958
lea eax, [ebp - 0x10]
push eax
call fcn.0043bee5
pop ecx
jmp 0x43b96b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x43ba36
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0043bfd7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43ba36
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x43ba36
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x43ba36
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43b9c3
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00436d9c
test ebx, ebx
je 0x43ba31
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00436d9c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43ba36
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43ba36
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004428e9
add esp, 0x10
xor eax, eax
inc eax
jmp 0x43ba38
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040adc8
leave
ret
Function at 0x43c0dd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0043627a
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43c14c
cmp esi, dword [ebp - 4]
je 0x43c147
cmp dword [ebp + 0xc], 0
je 0x43c147
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x43c124
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0043c1a6
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x43c14e
xor eax, eax
inc eax
jmp 0x43c14e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x43f367
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43f404
push ebx
push esi
call fcn.0043f455
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00436129
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43f3b1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43f403
push edi
push eax
call fcn.00436019
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43f3d1
call fcn.00435fdf
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43f402
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00436129
add esp, 0x20
test eax, eax
jne 0x43f3f0
push edi
call fcn.00435fdf
jmp 0x43f3f8
push ebx
call fcn.00435fdf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x43f407
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x43f418
pop esi
ret
push ebx
push edi
push esi
call fcn.0043f455
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00436019
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43f440
push ebx
push esi
push edi
call fcn.004258c0
add esp, 0xc
push 0
call fcn.00435fdf
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x43f48c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043f497
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403730
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x40375e
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x403766
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x403795
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x4037bb
mov eax, 0x405810
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x4037e4
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x4037e4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4037e4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.004033e7
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4106b6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestRefPtr.exe_gMozillaPoisonSize], eax
call fcn.0040c90f
pop ecx
mov ecx, dword [sym.TestRefPtr.exe_gMozillaPoisonSize]
mov dword [sym.TestRefPtr.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x4106ee
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestRefPtr.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx