joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401400
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x401500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40155b
cmp byte [esi + ebx - 1], 0xa
je 0x40152f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x405094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401c40
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x405094]
movzx eax, al
bt eax, esi
jae 0x401ca0
mov ecx, dword [0x405084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401b46
test byte [0x402018], 8
jne 0x401be0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402028], 8
jne 0x401b90
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b15
cmp esi, 3
jbe 0x401b50
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4030dc]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401b15
mov ecx, dword [0x405094]
test ecx, ecx
je 0x401c80
mov dword [esp], 0x402028
call dword [0x405094]
test al, 8
je 0x401aec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401aec
mov ebx, dword [0x405094]
test ebx, ebx
je 0x401c60
mov dword [esp], 0x402018
call dword [0x405094]
test al, 8
je 0x401ad9
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
shr edx, 6
imul ebx, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, ebx
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401adf
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401aa0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401bea
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401b9e
mov eax, 0xffffffff
jmp 0x401b46
Function at 0x8de088
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de08e
pop ebp
sub ebp, 6
sub ebp, 0x4de088
jmp 0x8de0ec
jmp 0x8de0f5
mov eax, 0x4de088
add eax, ebp
add eax, 0x93
mov ecx, 0x620
mov edx, 0xfe6606bf
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de10c
jmp 0x8de11f
scasb al, byte es:[edi]
pop ss
aad 0xff
xlatb
mov edi, 0xd7bfbfaf
mov edi, 0x8cbf9373
jg 0x8de11d
inc eax
sub al, byte [ebx - 0x10400462]
xor al, 0x72
xor al, 0x36
cmp dword [edi + 0x7e3ebfbf], 0x47
mov edi, 0x72bcbfbf
pop es
mov ecx, 0x5bfbfbf
xchg edi, eax
mov edi, 0x5d48bfbf
mov esp, 0xb33e3477
mov edi, 0x7abcbfbf
out dx, eax
xlatb
or byte [edx - 0x828404a], 0x14
sti
mov edi, 0xd79b93be
mov edi, 0x57bfbfbf
mov edx, 0x56bfbfbf
xchg edi, eax
mov edi, 0xebeabfbf
loop 0x8de1b0
cmp dh, byte [edi + 0x34bfbfbf]
sub dh, byte [ebx + 0x34bfbfbf]
xor ch, byte [edi + 0x7ebfbfbf]
push esi
mov ebp, 0x7d3cbd8e
mov ebx, 0x4b3ab0f6
inc eax
inc eax
inc eax
loop 0x8de21b
mov bl, 0xbf
xor al, 0x33
wait
mov ebx, 0xd7bfbfbf
or byte [edx - 0x828404a], 0x14
sti
mov edi, 0xee9b93be
xchg ebx, eax
wait
out dx, al
push edi
mov edx, 0x56bfbfbf
cmp byte [ebp - 0x14154041], 0xe2
inc eax
retf 0x40b3
xrelease xchg byte [esi + 0x3cba7e3c], bh
push edi
mov ebx, 0x40400256
inc eax
xchg esi, eax
jmp 0x8de1b2
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
movsb byte es:[edi], byte [esi]
sub ah, 0x8b
inc ebp
or byte [ebx + 0x40c0c80d], cl
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0x74
rol byte [eax], cl
push ecx
call dword [0xde40c180]
invalid
inc eax
invalid

Function at 0x405e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pminub mm4, qword [ecx]
or eax, 0xe4840fd5
add dword [eax], eax
add byte [eax + 0x5090d001], dl

Function at 0x40626a
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x40626d
mov eax, 0x50402f3
out dx, al
clc
div esi
cmc
retf 0x3d52

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401506
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x447008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xfffe
call fcn.004014e0
mov esi, eax
test esi, esi
je 0x4015d7
push 0x7fff
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, esi
mov edi, eax
call fcn.004014f1
cmp edi, 0xffffffff
je 0x4015d7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov ecx, esi
call fcn.004014e0
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebx + 0x3c]
xor eax, eax
add edi, ebx
xor esi, esi
cmp ax, word [edi + 6]
jae 0x4015d7
movzx edx, word [edi + 0x14]
movzx eax, si
imul ecx, eax, 0x28
mov byte [ebp - 8], 0
push str..INFO
mov dword [ebp - 0x1c], edx
add ecx, edi
mov dword [ebp - 0x18], ecx
mov eax, dword [edx + ecx + 0x18]
mov ecx, dword [edx + ecx + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4015e8
inc esi
cmp si, word [edi + 6]
jb 0x401599
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040328f
leave
ret
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + eax + 0x2c]
add eax, ebx
jmp 0x4015d9
Function at 0x4023e1
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x447008]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
xor esi, esi
lea ebx, [edi + 8]
push dword [esi + 0x443088]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402558
add esi, 4
cmp esi, 0x18
jb 0x402409
push 0xfffe
call fcn.00425390
mov esi, eax
pop ecx
test esi, esi
je 0x402558
push edi
push str._s
push 0x7fff
push esi
call fcn.00401714
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40252b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x44]
push eax
push edi
push str._s_s
push 0x7fff
push esi
call fcn.00401714
add esp, 0x14
lea eax, [esp + 0x44]
test byte [esp + 0x18], 0x10
je 0x4024bb
push 0x442de4
push eax
call ebx
test eax, eax
je 0x40250a
push 0x442de8
lea eax, [esp + 0x48]
push eax
call ebx
test eax, eax
je 0x40250a
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.004023e1
jmp 0x40250a
push dword [0x44acd4]
push eax
call ebx
test eax, eax
je 0x40250a
mov eax, dword [0x44acf0]
add eax, 0x240
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x40250a
mov eax, dword [0x44acf0]
add eax, 0x308
push eax
lea eax, [esp + 0x48]
push eax
call ebx
test eax, eax
je 0x40250a
test byte [esp + 0x18], 0xa7
je 0x40250a
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.00401f08
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40246e
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x44acf0]
add eax, 0x308
push eax
push edi
push str._s_s
push 0x7fff
push esi
call fcn.00401714
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.00425375
pop ecx
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040328f
mov esp, ebp
pop ebp
ret

Function at 0x40256d
Capabilities:
Get disk information

Disassembly:
push 0x34
mov eax, 0x434627
call fcn.00433c3d
mov dword [ebp - 0x3c], ecx
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__lambda_1b66822170d79c5ee861e3cc08eff673___void__struct__NETRESOURCEW__.0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x41
pop edi
push 0x1a
mov ebx, eax
pop eax
mov dword [ebp - 0x40], eax
test bl, 1
je 0x4025e4
push 0x208
call fcn.00425390
mov esi, eax
pop ecx
test esi, esi
je 0x4025e1
push edi
push 0x443078
push 0x104
push esi
call fcn.00401714
mov edx, dword [ebp - 0x3c]
mov ecx, esi
call fcn.004023e1
push esi
call fcn.00425375
add esp, 0x14
mov eax, dword [ebp - 0x40]
shr ebx, 1
inc edi
sub eax, 1
mov dword [ebp - 0x40], eax
jne 0x4025a7
lea ecx, [ebp - 0x38]
call fcn.004027ca
call fcn.00433bf8
ret
Function at 0x4025fd
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x447008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], 0x4000
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], ebx
push ecx
push eax
push 0
push 0
push 2
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x402721
push esi
push dword [ebp - 0xc]
call fcn.00425390
mov esi, eax
pop ecx
test esi, esi
je 0x402717
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x402710
push edi
and dword [ebp - 0x1c], 0
cmp dword [ebp - 8], 0
jle 0x4026ea
lea edi, [esi + 0x14]
test dword [edi - 8], 2
je 0x40269d
lea eax, [edi - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x402730
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
call dword [eax + 8]
jmp 0x4026db
push 0x208
call fcn.00425390
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4026d8
push dword [edi]
push str.__s
push 0x104
push ebx
call fcn.00401714
mov edx, dword [ebp - 0x18]
mov ecx, ebx
mov edx, dword [edx + 4]
mov edx, dword [edx]
call fcn.004023e1
push ebx
call fcn.00425375
add esp, 0x14
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add edi, 0x20
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 8]
jl 0x402676
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x4000
push eax
push dword [ebp - 0x10]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x402669
pop edi
push esi
call fcn.00425375
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040328f
leave
ret 4
call fcn.00403f4c
int3

Function at 0x42b10a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ad87

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40aabf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestSplayTree.exe_gMozillaPoisonSize], eax
call fcn.0040852e
pop ecx
mov ecx, dword [sym.TestSplayTree.exe_gMozillaPoisonSize]
mov dword [sym.TestSplayTree.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40aaf7
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestSplayTree.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
or esi, 0xffffffff
test eax, eax
je 0x10001037
cmp byte [eax + 0x1a], 0
je 0x10001037
push dword [eax + 0x299]
add eax, 0x29d
push eax
push 3
push 0
push 0x10010010
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10001037
xor esi, esi
mov eax, esi
pop esi
ret

Function at 0x1000103b
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
or edi, 0xffffffff
push dword [esp + 0x14]
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [esp + 0x14]
push esi
push 0x10010020
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001081
push str._system32
push esi
call sub.MSVCRT.dll_strcat
push dword [esp + 0x14]
push esi
call sub.MSVCRT.dll_strcat
add esp, 0x10
xor edi, edi
mov eax, edi
pop edi
pop esi
ret
Function at 0x100012f0
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b58
call fcn.1000d330
push esi
push edi
push 0x41
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x137]
mov byte [ebp - 0x138], dl
rep stosd dword es:[edi], eax
push 0x41
lea edi, [ebp - 0x347]
pop ecx
mov byte [ebp - 0x348], dl
rep stosd dword es:[edi], eax
push 0x40
lea edi, [ebp - 0x23d]
pop ecx
mov byte [ebp - 0x240], 0x99
mov byte [ebp - 0x23f], 0x3a
mov byte [ebp - 0x23e], 0x5c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x30], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x2f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0xf]
mov byte [ebp - 0x10], dl
mov ecx, 0x4203
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x10b57]
mov byte [ebp - 0x10b58], dl
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp esi, edx
stosb byte es:[edi], al
jne 0x10001398
or eax, 0xffffffff
jmp 0x100014c5
lea eax, [ebp - 0x138]
push 0x105
push eax
push 0x10010020
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x100013be
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100014c5
push ebx
lea eax, [esi + 0x160]
push 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [esi + 0x170]
push 0x10
push eax
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll_memcpy
add esi, 0x150
push 0x10
lea eax, [ebp - 0x30]
push esi
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x138]
push str._system32
push eax
call sub.MSVCRT.dll_strcat
mov esi, 0x104
lea eax, [ebp - 0x138]
push esi
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x40
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x348]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, eax
mov al, byte [ebp + 0xc]
add esp, 0x10
dec edi
mov byte [ebp - 0x240], al
lea ebx, [ebp - 0x10b58]
mov dword [ebp + 0xc], 7
lea eax, [ebp - 0x138]
push esi
push eax
push ebx
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x23e]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x18
inc byte [ebp - 0xd]
inc byte [edi]
add ebx, esi
dec dword [ebp + 0xc]
jne 0x10001470
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 4
lea edi, [ebp - 0x10b58]
pop ebx
push edi
call esi
add edi, 0x208
dec ebx
jne 0x100014ad
lea eax, [ebp - 0x348]
push eax
call esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x100014c9
Capabilities:
Delete file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
lea eax, [ebp - 4]
push esi
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.100015f7
test eax, eax
pop ecx
jne 0x100015f1
cmp byte [0x10010758], bl
mov eax, dword [ebp - 4]
jne 0x10001509
movzx ecx, byte [eax + 0x1a]
mov dword [0x10010754], ecx
mov byte [0x10010758], 1
cmp dword [0x10010754], ebx
je 0x100015f1
push 3
push dword [ebp + 8]
push eax
call fcn.100010a1
add esp, 0xc
dec dword [0x10010754]
mov esi, eax
jne 0x100015f1
mov edx, dword [ebp - 4]
cmp byte [edx + 0x20], bl
je 0x100015e4
mov al, byte [0x1001076c]
push edi
mov byte [ebp - 8], al
xor eax, eax
lea edi, [ebp - 7]
push 0x40
stosw word es:[edi], ax
pop ecx
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], bl
or dword [ebp - 0x10], 0xffffffff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push 0x104
add edx, 0x21
push eax
push edx
call fcn.1000103b
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push ebx
push 0xf003f
push ebx
push ebx
add eax, 0x31
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
pop edi
cmp esi, ebx
jne 0x100015e4
lea eax, [ebp - 8]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push 1
add eax, 0x130
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.100012f0
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x100015f7
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10010028
push 0x65
push dword [0x10010750]
or ebp, 0xffffffff
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x10001688
push esi
push dword [0x10010750]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10001688
push esi
push dword [0x10010750]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, dword [esp + 0x18]
pop ecx
test eax, eax
mov dword [esi], eax
je 0x10001690
push edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10001690
push edi
push eax
push dword [esi]
call sub.MSVCRT.dll_memcpy
mov ecx, 0x62c
add esp, 0xc
cmp edi, ecx
jne 0x10001690
mov esi, dword [esi]
xor eax, eax
xor byte [esi + eax], 0xcd
inc eax
cmp eax, ecx
jb 0x1000167b
xor ebp, ebp
jmp 0x10001690
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret