joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40617e
Capabilities:
Copy file
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov esi, eax
push 0x104
lea eax, [ebp - 0x214]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push str.c:DLA.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push 0x80
push 3
push edi
push 1
push 0x40000000
push str.C:DLA.EXE
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
jne 0x4061e5
mov dword [ebp + 8], 0x73
jmp 0x4062b6
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x406201
mov dword [ebp + 8], 0x74
jmp 0x4062ad
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40621c
mov dword [ebp + 8], 0x76
jmp 0x4062ad
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call edi
test eax, eax
je 0x4062ad
lea eax, [ebx + esi + 8]
lea esi, [eax + 7]
and esi, 0xfffffff8
sub esi, eax
push esi
mov dword [ebp - 8], eax
call fcn.0040ebbc
push esi
push 0
push eax
mov dword [ebp + 8], eax
call fcn.00429890
add esp, 0x10
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call edi
test eax, eax
je 0x40629e
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x40629e
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0xdeadbeef
call edi
cmp dword [ebp + 8], 0
je 0x4062ad
push dword [ebp + 8]
call fcn.0040ebb1
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x408fc2
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x43cbe7
call fcn.0043a764
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.00409769
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.00404177
mov eax, dword [eax + 0xcc]
call fcn.00408773
xor edi, edi
push 1
push edi
push edi
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00403884
push eax
push str.open
call fcn.00404142
mov eax, dword [eax + 0x20]
push dword [eax + 0x20]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004015a7
push 3
push edi
push edi
push edi
push edi
push 0x453468
mov ecx, esi
call fcn.00404177
mov ecx, eax
call fcn.004195df
call fcn.0040909a
push edi
push 0x3e8
push 1
mov ecx, esi
call fcn.0040979d
mov ecx, esi
call fcn.00408d59
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4097ec
Capabilities:
Resume thread

Disassembly:
push dword [ecx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x41520f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x415256
call fcn.0040f486
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x415256
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x415272
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00414d0f
mov esi, eax
test edi, edi
je 0x415270
test ebx, ebx
je 0x415270
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4184bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4184d5
mov edi, dword [esi + 0xc]
jmp 0x418515
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4184ee
call fcn.00416490
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x418503
call fcn.00416490
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x418515
call fcn.00416490
call fcn.0040f486
cmp dword [eax + 0x3c], 0
je 0x41852a
push edi
mov ecx, ebx
call fcn.0041734f
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004183d7
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x418548
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x418554
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41a11c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x41a140
cmp dword [edi + 0x74], 0
jne 0x41a140
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0040f486
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041a0dd
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41b146
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x41b171
call fcn.0040f486
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x41b194
push eax
push dword [esi + 4]
call fcn.0041b0cc
push esi
push eax
mov ecx, 0x453770
call fcn.0041ad4f
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x41baa2
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x43b1f6
call fcn.00429781
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov ebx, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041ba62
and dword [ebp - 4], 0
mov dword [esi], vtable.CHttpConnection.0
call fcn.00415c71
push eax
lea ecx, [esi + 0x18]
call fcn.004015ac
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00401af9
push dword [esi + 8]
mov ebx, dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
jne 0x41bb19
push eax
push dword [esi + 8]
call fcn.0041b0cc
push dword [esi + 0xc]
mov ecx, 0x453770
push eax
call fcn.0041ad4f
mov eax, esi
call fcn.00429859
ret 0x18

Function at 0x41be7a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4500e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x41bebf
push 0x4405c0
push 4
push eax
call fcn.00427b97
push eax
call fcn.004016a2
add esp, 0x10
jmp 0x41bed5
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41bf55
push edi
call fcn.00429c44
mov edi, dword [eax]
call fcn.00429c44
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00429352
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.00429c44
cmp dword [eax], 0
je 0x41bf29
call fcn.00429c44
push dword [eax]
call fcn.0040f509
pop ecx
jmp 0x41bf30
call fcn.00429c44
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x41bf55
cmp dword [ebp - 0x234], esi
jae 0x41bf55
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x41bf57
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00429373
leave
ret
Function at 0x41c3f6
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4500e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.0040372d
pop ecx
cmp eax, esi
je 0x41c4e0
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x41c4e0
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.00429890
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x41c4e0
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x41c4e0
cmp esi, 0x14
jge 0x41c4e0
push 0x10
push 0
push edi
call fcn.00428e66
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x41c4cf
call fcn.00429c44
cmp dword [eax], 0x22
je 0x41c4cf
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.00429382
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x41c4a5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x4537b4], 0
jne 0x41c56b
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x41c594
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.0041be7a
pop ecx
pop ecx
test eax, eax
jne 0x41c596
inc edi
cmp edi, esi
jl 0x41c571
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429373
leave
ret 8

Function at 0x429373
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4500e0]
jne 0x42937d
repz ret
jmp fcn.0043179e
Function at 0x435992
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4500e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042de38
and dword [ebp - 0x14], 0
cmp dword [0x4548e0], 0
mov dword [ebp - 0x18], eax
jne 0x435a45
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x435aed
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x442fd0
push ebx
call edi
test eax, eax
je 0x435aed
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x442fc0
push ebx
mov dword [0x4548e0], eax
call edi
push eax
call esi
push 0x442fac
push ebx
mov dword [0x4548e4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4548e8], eax
call edi
push eax
call esi
mov dword [0x4548f0], eax
test eax, eax
je 0x435a45
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4548ec], eax
mov eax, dword [0x4548ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x435a9e
cmp dword [0x4548f0], ecx
je 0x435a9e
push eax
call esi
push dword [0x4548f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x435a9e
test ebx, ebx
je 0x435a9e
call edi
test eax, eax
je 0x435a95
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x435a95
test byte [ebp - 8], 1
jne 0x435a9e
or dword [ebp + 0x10], 0x200000
jmp 0x435ad1
mov eax, dword [0x4548e4]
cmp eax, dword [ebp - 0x18]
je 0x435ad1
push eax
call esi
test eax, eax
je 0x435ad1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x435ad1
mov eax, dword [0x4548e8]
cmp eax, dword [ebp - 0x18]
je 0x435ad1
push eax
call esi
test eax, eax
je 0x435ad1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4548e0]
call esi
test eax, eax
je 0x435aed
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x435aef
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429373
leave
ret
Function at 0x40105b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x820004]
jne 0x401065
repz ret
jmp fcn.00401684

Function at 0x4048ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x820004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040382b
and dword [ebp - 0x14], 0
cmp dword [0x822a2c], 0
mov dword [ebp - 0x18], eax
jne 0x40495e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404a06
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404a06
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x822a2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x822a30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x822a34], eax
call edi
push eax
call esi
mov dword [0x822a3c], eax
test eax, eax
je 0x40495e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x822a38], eax
mov eax, dword [0x822a38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4049b7
cmp dword [0x822a3c], ecx
je 0x4049b7
push eax
call esi
push dword [0x822a3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4049b7
test ebx, ebx
je 0x4049b7
call edi
test eax, eax
je 0x4049ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4049ae
test byte [ebp - 8], 1
jne 0x4049b7
or dword [ebp + 0x10], 0x200000
jmp 0x4049ea
mov eax, dword [0x822a30]
cmp eax, dword [ebp - 0x18]
je 0x4049ea
push eax
call esi
test eax, eax
je 0x4049ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4049ea
mov eax, dword [0x822a34]
cmp eax, dword [ebp - 0x18]
je 0x4049ea
push eax
call esi
test eax, eax
je 0x4049ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x822a2c]
call esi
test eax, eax
je 0x404a06
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404a08
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040105b
leave
ret
Function at 0x409954
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x409998
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x409967
jmp 0x409998
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x409988
pop esi
pop ebp
ret

Function at 0x40a732
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40a767
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40a791
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40a791
test edi, edi
je 0x40a75e
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40a75e
test edi, edi
je 0x40a799
mov eax, edi
jmp 0x40a760
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40a760
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040dbbd
add esp, 0xc
int3
Function at 0x40dbf1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestScopeExit.exe_gMozillaPoisonSize], eax
call fcn.0040a732
pop ecx
mov ecx, dword [sym.TestScopeExit.exe_gMozillaPoisonSize]
mov dword [sym.TestScopeExit.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40dc29
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestScopeExit.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x75493f13
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1a30399c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x404532
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x404541
pop dword [ebp - 0x50]
mov eax, 0x5f8f831d
sub eax, 0x5f4f3ddc
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x35402
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x3591cf45
sub ecx, 0x35919717
mov edi, eax
mov esi, 0x413bc4
add esi, dword [ebp - 0x50]
mov ebx, 0xd2177d08
add ebx, 0xe7189174
xor dword [ebp - 0x10], eax
mov edx, dword [esi]
mov dword [ebp - 0xc], 0x11b80b34
sub edx, ebx
sub dword [ebp - 0x4c], edi
mov dword [edi], edx
xor dword [ebp - 0x44], edi
add edi, 0x8040b8b4
add edi, 0x7fbf4750
add esi, 4
loop 0x404595
add eax, 0x2c47dc0b
add eax, 0xd3b8f780
mov ebx, eax
add eax, 0x2f2ff2b9
sub eax, 0x2f2ff2b4
mov ecx, 0xa9556a98
add ecx, 0x56ea9568
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x449c40
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x64df19
mov esi, eax
call fcn.00449c10
add esp, 4
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov esi, ebx
and esi, 0xff
test edi, edi
je 0x449c8d
mov ecx, dword [0x64dd54]
push 0x64da6c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
xor eax, eax
cmp esi, 5
mov al, bh
jne 0x449caa
cmp eax, 1
jae 0x449cbb
pop edi
pop esi
mov dword [0x64d258], 0x409
pop ebx
pop ecx
ret
ja 0x449cbb
pop edi
pop esi
mov dword [0x64d258], 0x409
pop ebx
pop ecx
ret
pop edi
pop esi
mov dword [0x64d258], 0x7f
pop ebx
pop ecx
ret

Function at 0x472089
Capabilities:
Encode data using xor

Disassembly:
sti
mov byte [0xec3e151b], al
xor cl, byte [ebp - 0x1f8a44d2]
mov dword [ecx - 0x1b], esi
cmp dword [edi - 0x6a], ebx
xchg ah, cl
sub eax, 0xf86f6fd
sub ebx, dword [ebp - 0x617c14a2]
sub al, 0x82
jge 0x47208a
movsd dword es:[edi], dword [esi]
mov ch, byte [ebp - 0x12]
imul esp, dword [ebp - 0x5c], 0x8ffcb1a3
dec edx
mov esi, 0x320f6632
in eax, dx
dec ebp
aas
inc esp
push ecx
mov edi, 0xad0c351a
xchg ebp, eax
pop esp
xlatb
xchg byte [esi], bl
int1
mov cl, 0x4c
or ebp, dword [edi + 0x5d9f6d98]
xchg ebx, eax
retf
Function at 0x4bb99a
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov al, byte [0xa27396ca]
scasb al, byte es:[edi]
mov dl, 0x2d
cmpsb byte [esi], byte es:[edi]
dec ebp
add ebx, dword [ebp - 0x1e]
push edi
repne cmpsb byte [esi], byte es:[edi]
xchg dword [edx - 0x4fbd76ee], edi
cld
jp 0x4bba1d
mov dl, 0xa2
loopne 0x4bb991
jne 0x4bba23
and dword [0xfd6df1fc], ebx
dec edi
inc ebx
xlatb
sar dword [esi + 0x6b], 0x7c
insd dword es:[edi], dx
pop esp
mov byte [0x9a7401a9], al
mov byte [esp + esi*8], al
push esi
pop esp
sti
xchg edi, eax
adc eax, 0x4dd7fe4c
fist word [eax - 0x6c086ee0]
xchg edx, eax
add ecx, dword [0x5c406eb0]
xchg esi, eax
sbb ch, byte [eax - 0x66fc975b]
xchg edx, eax
mov eax, dword [0xf962aa13]
stc
dec edi
int1
inc ebx
or cl, byte [ecx]
sub al, 0xec
or eax, 0x61b2f001
fldcw word [edx]
test edi, esi
rol dword [ebp - 0x2b], 1
mov ecx, 0x954a918c
xor esp, dword [ebp - 0x59]
dec edi
fcmovb st(0), st(5)
aas
bound ebx, qword [ebx + 0x73]
pop esp
push 0x69
sub byte [0xdc8b013b], 0x31
sysenter
imul ecx, dword [esi], 0xffffffad
imul edi, dword [0x978989bd], 0xd562cc0d
cli
or eax, 0xfad562cc
cdq
insb byte es:[edi], dx
std
loop 0x4bba69
mov al, byte [0xe33bc9d2]
sti
xchg ebx, eax
sbb al, 0x4d
cmp bl, byte [0x697f35bd]
jge 0x4bba93
loope 0x4bb9ea
lodsd eax, dword [esi]
inc ebx
push cs
mov dh, 0x66
wait
mov al, 0xcf
or bh, byte [ecx - 0x67f2e370]
mov al, 0xbb
test al, 0x99
cmpsd dword [esi], dword es:[edi]
iretd
invalid
outsd dx, dword [esi]
popfd
pop ebx
jmp [edi + 0x2e]
insd dword es:[edi], dx
das
mov ebp, 0xc1a50ac3
idiv ecx
movsd dword es:[edi], dword [esi]
adc esp, dword [esi + 0x16a0ac27]
je 0x4bba34
and eax, 0x20c99965
xchg dword [ebx + 0x71fa24d4], ebp
adc byte [esi - 0x1f15162], ch
imul esi, dword [ebp + 0x1d], 0xffffff8b
in eax, dx
stc
cmp edx, eax
in eax, 0x12
cwde
xor ch, byte [ebx - 0x1a5f9fc8]
insb byte es:[edi], dx
xchg dword [eax - 0x21], esi
aam 0x1e
sal ah, 0x76
js 0x4bba60
push ecx
xchg esi, eax
add ah, byte [edx + 0x34c331ad]
mov bl, 0x6f
adc dh, bl
invalid

Function at 0x5f3d09
Capabilities:
Encode data using xor

Disassembly:
das
push cs
jg 0x5f3d58
mov edx, 0xc855136b
adc edx, dword [ebp - 0x38]
retf 0x4075
add edi, dword [edi + 0x5d351e87]
adc dword [ecx], edi
loope 0x5f3dd0
inc esp
jae 0x5f3d76
in eax, dx
mov ebp, 0x9aee87d5
aas
leave
jbe 0x5f3d0f
sahf
adc edx, esi
or dword [edx - 0x20ac3503], edi
invalid
push ebx
invalid
or al, 0x24
scasb al, byte es:[edi]
outsb dx, byte [esi]
imul ebp, dword [esi - 0x75], 0x9e9f0257
invalid