joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407559
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40757a
jl 0x407571
test edi, edi
jne 0x40757a
xor eax, eax
xor edx, edx
jmp 0x40763b
cmp dword [ebx + 0x38], 0
je 0x40758f
push eax
push edi
push dword [ebp + 8]
call fcn.00407641
jmp 0x40763b
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4075d6
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4075d6
cmp eax, edi
jb 0x4075b0
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409b50
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4075dc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x407630
mov ecx, ebx
call fcn.00406df0
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40761b
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00417311
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x407630
jmp 0x4075ee
test edx, edx
je 0x407630
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00417311
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x409121
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409160
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409160
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409160
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409160
cmp dword [ecx + 0x74], 0xe
jbe 0x409160
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41e4b2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4307f0
push 0x4307e8
push str.FlsAlloc
push 0x1e
call fcn.0041e31f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e4e6
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c134]
call esi
jmp 0x41e4ec
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41e530
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430800
push 0x4307f8
push str.FlsGetValue
push 0x20
call fcn.0041e31f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e567
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41f866
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f6d7

Function at 0x41fc60
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00409290
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041cbea
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41fca2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41fdfe
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042ac60
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x439bf0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00420c57
mov ecx, dword [esi*4 + 0x439bf0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41fdf7
cmp eax, dword [edi + ecx + 0x24]
jne 0x41fdf7
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41fdf7
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00420c57
add esp, 0x14
test edx, edx
jl 0x41fdf7
jg 0x41fd6d
test eax, eax
jb 0x41fdf7
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41fdf7
jl 0x41fd87
cmp dword [ebp - 0x1008], eax
ja 0x41fdf7
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41fda5
test ebx, ebx
je 0x41fdde
cmp ecx, edi
jae 0x41fdde
mov al, byte [ecx]
cmp al, 0xd
jne 0x41fdbf
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41fdcb
cmp byte [ecx + 1], 0xa
jne 0x41fdcb
inc ecx
jmp 0x41fdcb
movzx eax, al
movsx eax, byte [eax + 0x438310]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41fda5
cmp edx, ebx
jne 0x41fda5
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41fdfc
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004084dd
leave
ret
Function at 0x4200f5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x439bf0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x420135
cmp byte [ebx], 0xa
jne 0x420135
or byte [eax + edi + 0x28], 4
jmp 0x42013a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x420238
mov al, byte [edx]
cmp al, 0x1a
je 0x42021a
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x420169
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x42018e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x420198
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x42014b
jmp 0x420238
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420215
cmp dword [ebp - 0xc], 0
je 0x420215
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x439bf0]
test byte [eax + edi + 0x28], 0x48
je 0x4201ef
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4201da
mov byte [esi], dl
jmp 0x4201eb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x439bf0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x420238
cmp byte [ebp - 1], 0xa
jne 0x4201fe
cmp esi, ebx
jne 0x4201fe
mov byte [esi], 0xa
jmp 0x420237
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00420c75
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x420238
mov byte [esi], 0xd
jmp 0x420237
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x439bf0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x420234
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x420238
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x420241
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x439bf0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x420284
cmp word [esi], dx
jne 0x420284
or byte [edi + eax + 0x28], 4
jmp 0x420289
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4203dc
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4203bc
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4202cb
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x420301
cmp eax, edx
jae 0x42030d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4202a3
jmp 0x4203dc
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4203b8
cmp dword [ebp - 0x14], 0
je 0x4203b8
mov eax, dword [ebx*4 + 0x439bf0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x420390
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x420359
mov word [esi], cx
jmp 0x42038c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x439bf0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x439bf0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x439bf0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4203dc
pop ebx
cmp word [ebp - 4], bx
jne 0x4203a1
cmp esi, dword [ebp + 0xc]
jne 0x4203a1
mov word [esi], bx
jmp 0x4203d9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00420c75
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4203dc
push 0xd
jmp 0x4203d5
mov ecx, dword [ebx*4 + 0x439bf0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4203d3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4203dc
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42322e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4232cb
push ebx
push esi
call fcn.004231f7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00421e7c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x423278
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4232ca
push edi
push eax
call fcn.0041bcf9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x423298
call fcn.0041bcbf
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4232c9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00421e7c
add esp, 0x20
test eax, eax
jne 0x4232b7
push edi
call fcn.0041bcbf
jmp 0x4232bf
push ebx
call fcn.0041bcbf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42aa60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42aa8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42aa8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2e001137
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x2e001146
pop dword [ebp - 0x38]
mov eax, 0x53836421
sub eax, 0x258352db
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xc0a5e9a5
sub dword [ebp - 0x48], 0x7253a45a
mov dword [ebp - 0x44], 0x4a72c34e
sub dword [ebp - 0x44], 0x183f7709
mov dword [ebp - 0x40], 0xa77f8789
add dword [ebp - 0x40], 0xa4ccbca5
mov dword [ebp - 0x3c], 0xc06ab81
add dword [ebp - 0x3c], 0xf3f9547f
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x54f7d929
add dword [ebp - 0x48], 0x1f7a902d
mov dword [ebp - 0x44], 0xc66c335d
sub dword [ebp - 0x44], 0x84ffd1e8
mov dword [ebp - 0x40], 0x9b7b86b0
sub dword [ebp - 0x40], 0x380c1a44
mov dword [ebp - 0x3c], 0xeef1a4af
add dword [ebp - 0x3c], 0x110e5b51
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xee9d6387
sub eax, 0xc09a32cb
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x43e88
push 0
call eax
mov ecx, 0xb2325a31
sub ecx, 0xb23206f1
xor edx, edx
add edx, eax
mov ebx, 0x1ead8d34
add ebx, 0xf57f0cc
add ebx, dword [ebp - 0x38]
mov esi, 0x92e2d320
add dword [ebp - 0x1c], edi
mov edi, dword [ebx]
mov dword [ebp - 0x28], 0xdb98787f
xor edi, esi
mov dword [ebp - 8], 0xfb961af5
mov dword [edx], edi
xor dword [ebp - 0x1c], ecx
add edx, 0x16a8360e
sub edx, 0x16a8360a
add ebx, 0xb82682ad
add ebx, 0x47d97d57
loop 0x2e00125f
add eax, 0x96836118
sub eax, 0x96822145
xor ebx, ebx
add ebx, eax
add eax, 0x2dce95f2
sub eax, 0x2dce95ed
mov ecx, 0xaecbc96c
add ecx, 0x7f343694
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e001137
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e001137
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret
Function at 0x1000b80b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000b81a
pop dword [ebp - 0x30]
mov eax, 0x1000b81a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xb345608d
add dword [ebp - 0x40], 0x9b0ce4be
mov dword [ebp - 0x3c], 0x2f5c4eb2
add dword [ebp - 0x3c], 0x2d6fd93
mov dword [ebp - 0x38], 0x8ee3117c
sub dword [ebp - 0x38], 0x4296cd4e
mov dword [ebp - 0x34], 0x546b2b02
add dword [ebp - 0x34], 0xab94d4fe
lea eax, [ebp - 0x40]
push eax
mov eax, 0x272752fb
sub eax, 0x1725920f
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xadd63427
sub dword [ebp - 0x40], 0x3963cad1
mov dword [ebp - 0x3c], 0xf7a40dab
add dword [ebp - 0x3c], 0x49c853ca
mov dword [ebp - 0x38], 0x7522a429
add dword [ebp - 0x38], 0xee4cc843
mov dword [ebp - 0x34], 0xa5e18d14
add dword [ebp - 0x34], 0x5a1e72ec
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xd1563e35
add eax, 0x3eab8213
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3b858
push 0
call eax
mov ecx, 0xc7622c85
sub ecx, 0xc761e519
mov edx, eax
mov ebx, 0x61636121
add ebx, 0xae9f38df
add ebx, dword [ebp - 0x30]
mov esi, 0xab01ad6e
sub esi, 0x1f369a94
sub dword [ebp - 4], 0xf63ef8f2
mov edi, dword [ebx]
add dword [ebp - 0x1c], ebx
xor edi, esi
xor dword [ebp - 0x1c], 0xe8597bfe
mov dword [edx], edi
sub dword [ebp - 0xc], edx
add edx, 0x9ad3329a
sub edx, 0x9ad33296
add ebx, 0x95b93b36
sub ebx, 0x95b93b32
loop 0x1000b937
add eax, 0xb9e638ff
sub eax, 0xb9e5287c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8ed56eb1
sub ecx, 0x7ed56eb1
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d28
cmp byte [esi + ebx - 1], 0xa
je 0x401cfc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4030f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402280
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4016b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x40731c
cmp dword [edi], ebx
je 0x401755
push str._mozilla.org_observer_service_1
mov edx, 0x407ee8
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.00405dbf
mov eax, dword [ebp - 4]
test eax, eax
je 0x401735
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_qm
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_telemetry
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00405eac
mov eax, dword [ebp - 4]
test eax, eax
je 0x401755
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40178c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x40178c
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.00403570
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.0040582a
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4017a8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4017b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x4017c1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4017d1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x402ee0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00402e24
push 2
push 0x52
push str.SELECT_id__from_visit__visit_type_FROM_moz_historyvisits_WHERE_place_id_1_LIMIT_1
mov edi, dword [eax]
and dword [eax], 0
lea eax, [ebp - 0x18]
and dword [ebp - 8], 0
push eax
call dword [sym.imp.xul.dll_NS_CStringContainerInit2]
mov eax, dword [edi]
lea ecx, [ebp - 8]
add esp, 0x14
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
call dword [eax + 0x60]
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.xul.dll_NS_CStringContainerFinish]
inc dword [0x40a0e4]
mov esi, str._s__Expected_true__got_false_at_line__d
shr ebx, 0x1f
not bl
test bl, 1
mov ebx, str.c:_buildsmoz2_slavem_in_w32_000000000000000000000_build_src_toolkitcomponentsplaces_testscppplaces_test_harness.h
pop ecx
je 0x402f4e
inc dword [0x40a0e8]
jmp 0x402f5d
push 0x13c
push ebx
push esi
call fcn.00403570
add esp, 0xc
push dword [ebp + 0xc]
mov eax, dword [ebp - 8]
push dword [ebp + 8]
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x4c]
inc dword [0x40a0e4]
shr eax, 0x1f
not al
test al, 1
je 0x402f85
inc dword [0x40a0e8]
jmp 0x402f94
push 0x13f
push ebx
push esi
call fcn.00403570
add esp, 0xc
mov eax, dword [ebp - 8]
lea edx, [ebp - 1]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xcc]
inc dword [0x40a0e4]
shr eax, 0x1f
not al
test al, 1
je 0x402fbb
inc dword [0x40a0e8]
jmp 0x402fca
push 0x143
push ebx
push esi
call fcn.00403570
add esp, 0xc
cmp byte [ebp - 1], 0
jne 0x402fdf
mov eax, dword [ebp + 0x10]
and dword [eax], 0
and dword [eax + 4], 0
jmp 0x403093
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0x10]
push esi
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0xdc]
inc dword [0x40a0e4]
shr eax, 0x1f
not al
test al, 1
je 0x403008
inc dword [0x40a0e8]
jmp 0x40301b
push 0x14b
push ebx
push str._s__Expected_true__got_false_at_line__d
call fcn.00403570
add esp, 0xc
mov eax, dword [ebp - 8]
lea ecx, [esi + 8]
push ecx
push 1
push eax
mov edx, dword [eax]
call dword [edx + 0xdc]
inc dword [0x40a0e4]
shr eax, 0x1f
not al
test al, 1
je 0x403044
inc dword [0x40a0e8]
jmp 0x403057
push 0x14d
push ebx
push str._s__Expected_true__got_false_at_line__d
call fcn.00403570
add esp, 0xc
mov eax, dword [ebp - 8]
lea ecx, [esi + 0x10]
push ecx
push 2
push eax
mov edx, dword [eax]
call dword [edx + 0xd8]
inc dword [0x40a0e4]
shr eax, 0x1f
not al
test al, 1
je 0x403080
inc dword [0x40a0e8]
jmp 0x403093
push 0x14f
push ebx
push str._s__Expected_true__got_false_at_line__d
call fcn.00403570
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x4030a0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret