joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bfc71
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100f2333
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f21b0

Function at 0x100f2ae2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x1017c1e8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100f2b23
cmp byte [edx], 0xa
jne 0x100f2b23
or byte [eax + edi + 0x28], 4
jmp 0x100f2b28
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x100f2c19
mov al, byte [ebx]
cmp al, 0x1a
je 0x100f2bfa
cmp al, 0xd
je 0x100f2b51
mov byte [esi], al
inc esi
inc ebx
jmp 0x100f2bef
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x100f2b71
cmp byte [eax], 0xa
jne 0x100f2b66
push 2
mov byte [esi], 0xa
pop eax
jmp 0x100f2b6c
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x100f2bef
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100f2be8
cmp dword [ebp - 0x14], 0
je 0x100f2be8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1017c1e8]
test byte [eax + edi + 0x28], 0x48
je 0x100f2bbf
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x100f2baf
mov byte [esi], dl
jmp 0x100f2beb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1017c1e8]
mov byte [eax + edi + 0x2a], dl
jmp 0x100f2beb
cmp byte [ebp - 1], 0xa
jne 0x100f2bd1
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x100f2bd1
mov byte [esi], 0xa
jmp 0x100f2b6e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100e666e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100f2bec
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x100f2b3a
jmp 0x100f2c19
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1017c1e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100f2c14
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100f2c19
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f2c24
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x1017c1e8]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x100f2c68
cmp word [edx], bx
jne 0x100f2c68
or byte [edi + eax + 0x28], 4
jmp 0x100f2c6d
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x100f2dc1
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x100f2da1
cmp ax, word [ebp - 0x10]
je 0x100f2ca6
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x100f2d96
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x100f2ccc
push 0xa
pop ecx
cmp word [eax], cx
jne 0x100f2cbc
push ecx
pop eax
push 4
jmp 0x100f2cc1
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x100f2d90
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100f2d87
cmp dword [ebp - 0x18], 0
je 0x100f2d87
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x1017c1e8]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x100f2d53
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x100f2d17
mov word [esi], ax
jmp 0x100f2d4b
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x1017c1e8]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x1017c1e8]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x1017c1e8]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x100f2d96
cmp word [ebp - 4], ax
jne 0x100f2d68
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x100f2d68
mov word [esi], ax
add esi, 2
jmp 0x100f2d96
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100e666e
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100f2d93
jmp 0x100f2d8a
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x100f2c86
jmp 0x100f2dc1
mov ecx, dword [ecx*4 + 0x1017c1e8]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x100f2db8
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x100f2dc1
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f7693
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f7335
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x409700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x459424]
cwde
sub dword [0x445514], eax
inc word [0x459424]
dec dword [0x4448dc]
dec dword [0x43fb60]
mov eax, dword [0x4448dc]
mov ecx, dword [0x43fb60]
movzx edx, word [0x4504b0]
sub esp, 8
and eax, 0x7a5ff08a
push esi
or ecx, eax
push edi
sub edx, ecx
mov word [0x4504b0], dx
push 0
call fcn.0040a3c0
add esp, 4
cmp dword [0x44eb80], 0
mov esi, eax
mov edi, edx
mov dword [0x44d250], 0x92a00c1e
jne 0x40983c
mov eax, dword [0x44eb6c]
test eax, eax
jne 0x40983c
mov cx, word [0x4511f2]
movsx edx, cx
push eax
mov dword [0x44d434], edx
call fcn.0040a3c0
add esp, 4
sub eax, esi
sbb edx, edi
test edx, edx
jg 0x4097ec
jl 0x4097a3
test eax, eax
jae 0x4097ec
mov ax, word [0x4530fc]
mov ecx, dword [0x438e6c]
cwde
xor ecx, eax
xor ecx, 0x5ea0ad2f
mov dword [0x438e6c], ecx
push 0x3e8
call dword [0x44e99c]
add dword [0x4421d4], 0x64f989a5
push 0
call fcn.0040a3c0
add esp, 4
sub eax, esi
sbb edx, edi
mov dword [ebp - 4], edx
js 0x4097a3
jg 0x4097ec
test eax, eax
jb 0x4097a3
mov edx, dword [0x43f63c]
sar edx, 7
xor edx, 0xa697eda4
cmp edx, 0x73af3b45
jl 0x409821
mov eax, dword [0x43b290]
mov ecx, dword [0x447180]
mov edx, dword [0x448e20]
add eax, ecx
imul edx, eax
mov dword [0x448e20], edx
jmp 0x40983c
mov ecx, dword [0x441b88]
not ecx
imul ecx, ecx, 0x7c3a6082
mov eax, 0xd8c3d2b0
sub eax, ecx
or dword [0x44a240], eax
dec dword [0x44b8a0]
mov dx, word [0x45447c]
mov ecx, dword [0x44b8a0]
movsx eax, dx
add ecx, eax
cmp ecx, 0x809c20a8
pop edi
pop esi
jge 0x409868
or dword [0x439640], 0xe86252c
mov esp, ebp
pop ebp
ret
Function at 0x40b880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or dword [0x44d6c0], 0xf4404904
or dword [0x440d98], 0x8a30d0be
add dword [0x43d4b8], 0x8127b18c
push edi
mov edi, dword [ebp + 8]
xor edx, edx
test edi, edi
jle 0x40ba9a
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push ebx
jmp 0x40b8c0
dec dword [0x43d8ec]
mov ebx, dword [0x43d8ec]
mov ecx, 0xe05b2412
sub ecx, ebx
xor ecx, 0xf29dabc
sub dword [0x44bb00], ecx
cmp dword [eax], edx
mov ebx, dword [0x44cc78]
sbb ecx, ecx
or ebx, 0xea6dc741
mov dword [0x44cf50], ebx
sub dword [eax], edx
add dword [0x442898], 0x75de35f9
mov edx, dword [eax]
neg ecx
cmp edx, dword [esi]
sbb edx, edx
neg edx
add edx, ecx
mov ecx, dword [0x4484f0]
mov ebx, dword [0x436f0c]
sar ebx, 6
sar ecx, 2
lea ecx, [ebx + ecx - 0x7808e779]
movzx ebx, word [0x4582aa]
or ebx, ecx
mov word [0x4582aa], bx
mov ecx, dword [esi]
sub dword [eax], ecx
or dword [0x44785c], 0x8055a851
mov ebx, 1
add esi, 4
add eax, 4
sub edi, ebx
jne 0x40b8c0
test edx, edx
je 0x40ba98
nop
mov ecx, dword [0x444a48]
add dword [0x444a48], ebx
cmp ecx, 0xfdfdffff
jge 0x40b97e
or dword [0x442ec4], 0x184247d6
cmp dword [eax], edx
sbb esi, esi
add word [0x45518c], bx
mov cx, word [0x45518c]
movsx edi, cx
mov ecx, dword [0x440a94]
xor ecx, edi
mov edi, dword [0x43db08]
xor edi, ecx
neg esi
cmp edi, 0x90e5591
je 0x40ba00
mov ecx, dword [0x44d49c]
mov edi, dword [0x43f1e4]
or ecx, edi
mov edi, dword [0x438210]
mov ebx, dword [0x443104]
imul edi, ebx
mov ebx, 1
add dword [0x44d49c], ebx
or ecx, 0xde96c146
cmp ecx, edi
jl 0x40b9f6
mov ecx, dword [0x44c89c]
shl ecx, 6
or ecx, 0xdd724b0d
mov dword [0x437430], ecx
jmp 0x40ba00
and dword [0x439c1c], 0xdffc8f6b
sub dword [eax], edx
mov edx, dword [0x439a08]
xor edx, 0x79c7be18
cmp edx, 0x706d8f56
je 0x40ba22
add dword [0x44367c], 0xbf4d14c6
jmp 0x40ba3a
mov ecx, dword [0x43aaa8]
cmp ecx, 0x31e82d62
jle 0x40ba3a
mov dword [0x44a4d8], 0x5f9cfc29
mov edi, dword [0x439628]
mov ecx, dword [0x4447c4]
not edi
add ecx, edi
movzx edi, word [0x45a238]
and ecx, 0xbd427c3d
add edi, ecx
mov word [0x45a238], di
mov ecx, dword [0x43c90c]
mov edi, dword [0x44b5b8]
imul ecx, edi
mov dword [0x43c90c], ecx
mov ecx, dword [0x43f4ac]
mov edi, dword [0x449d1c]
add eax, 4
lea ecx, [edi + ecx + 1]
mov edx, esi
mov dword [0x449d1c], ecx
test esi, esi
jne 0x40b960
pop ebx
pop esi
mov dx, word [0x453152]
mov ecx, dword [0x44e5bc]
movsx eax, dx
shl ecx, 4
not eax
add eax, 0x54330115
sub ecx, 0x75ed2011
cmp ecx, eax
pop edi
jl 0x40bac9
xor dword [0x44b654], 0x8d9b121c
pop ebp
ret
Function at 0x40c070
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x456d0e]
movzx edx, word [0x454a64]
movsx ecx, ax
sar ecx, 6
mov eax, 0x999252d
sub eax, ecx
or eax, 0xeac6816b
and edx, eax
mov word [0x454a64], dx
mov eax, dword [0x44e550]
xor eax, 0x2b578c40
cmp eax, 0xe39990a9
jl 0x40c0d1
mov ecx, dword [0x43c4c0]
cmp ecx, 0xd41fb071
jg 0x40c0c6
add dword [0x44053c], 0xa46b0eda
jmp 0x40c0d1
mov edx, dword [0x43a184]
mov eax, dword [0x43d048]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0041b050
mov ecx, dword [0x44402c]
inc dword [0x44402c]
cmp ecx, 0x110003
mov esi, eax
jge 0x40c10e
mov eax, dword [0x436e8c]
movzx edx, word [0x4536d0]
and eax, 0x238fa139
imul edx, eax
mov word [0x4536d0], dx
mov ecx, edi
call fcn.00413f20
cmp esi, eax
je 0x40c174
lea esp, [esp]
and dword [0x44c930], 0xff86d376
mov byte [esi], 0
mov ecx, dword [0x4384c4]
movzx edx, word [0x44f448]
mov eax, 0xfed182ba
sub eax, ecx
xor eax, 0x60b591e1
imul edx, eax
mov word [0x44f448], dx
dec dword [0x4384c4]
movzx eax, word [0x451daa]
sub eax, 0x465102
mov ecx, edi
inc esi
mov word [0x451daa], ax
call fcn.00413f20
cmp esi, eax
jne 0x40c120
mov ecx, dword [0x4435b4]
mov edx, dword [0x441220]
lea eax, [edx + ecx]
mov ecx, dword [0x448ea0]
shl ecx, 5
or ecx, eax
cmp ecx, 0x4623cd42
jg 0x40c1c1
mov edx, dword [0x43b924]
mov eax, dword [0x440e78]
and edx, eax
cmp edx, 0x339d4ac2
jl 0x40c1c1
inc dword [0x43b724]
mov eax, dword [0x43b724]
and eax, 0x255b838e
or dword [0x44d874], eax
mov ecx, edi
call fcn.00429e50
pop edi
mov dword [0x4376a8], 0xfebffff7
pop esi
pop ebp
ret
Function at 0x41ec00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x44af70]
add eax, eax
push esi
mov esi, ecx
cmp eax, 0xc5692667
jne 0x41ec1b
add dword [0x44b2c8], 0x41811a52
call fcn.004012d0
movzx ecx, word [0x453ffe]
mov edx, dword [0x440bf4]
movsx eax, cx
movzx ecx, word [0x450180]
lea eax, [edx + eax - 0x66570cce]
imul ecx, eax
mov word [0x450180], cx
dec dword [0x440bf4]
cmp dword [esi + 0x18], 0
jne 0x41ece0
jmp 0x41ec60
mov edx, dword [0x4449b0]
cmp edx, 0xcd0793f8
jge 0x41ec82
movzx eax, word [0x450c4c]
add eax, 0x7e4cd337
mov word [0x450c4c], ax
jmp 0x41eca6
mov cx, word [0x454942]
mov dx, word [0x44f3fe]
movsx eax, cx
movsx ecx, dx
mov edx, dword [0x4385d8]
add eax, ecx
add eax, edx
xor dword [0x437514], eax
call fcn.0041ced0
mov dword [esi + 0x18], eax
mov eax, dword [0x446044]
dec dword [0x446044]
imul eax, eax, 0x3a99e03d
cmp eax, 0x591b45ca
jg 0x41ecda
movzx ecx, word [0x45a26a]
sub ecx, 0x24680852
mov word [0x45a26a], cx
cmp dword [esi + 0x18], 0
je 0x41ec60
mov eax, dword [0x43c67c]
or eax, 0xf9edf6bf
and dword [0x43e538], eax
pop esi
ret
Function at 0x42d5d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x44c6b8]
imul eax, eax, 0x4669aeff
mov dword [0x44c6b8], eax
mov dword [ecx], 0
mov eax, dword [0x4378dc]
sar eax, 8
or dword [0x43d314], eax
mov dword [ecx + 4], 0
movzx edx, word [0x450eec]
or edx, 0xcfede47e
mov word [0x450eec], dx
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x44b1c4]
add eax, 0xc2478d53
or dword [0x43b500], eax
mov dword [ecx + 0xc], 0xefcdab89
add dword [0x439c60], 0x870698e7
mov dword [ecx + 0x10], 0x98badcfe
inc dword [0x4466d0]
mov eax, dword [0x4466d0]
mov edx, dword [0x445454]
add eax, edx
movzx edx, word [0x450cbc]
xor edx, eax
mov word [0x450cbc], dx
mov dword [ecx + 0x14], 0x10325476
movzx eax, word [0x4507d8]
or eax, 0xb2080002
mov word [0x4507d8], ax
ret

Function at 0x42f1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x44c1c8]
add eax, eax
add dword [0x447e08], eax
or ecx, 0xffffffff
add dword [0x43e440], ecx
mov eax, dword [0x442320]
mov edx, dword [0x43e440]
sar eax, 9
imul edx, eax
add edx, 0x71248bcb
cmp edx, 0xf7fa0e75
jne 0x42f202
or dword [0x4417bc], 0xcfbb79ba
mov ax, word [0x4565ec]
movsx edx, ax
cmp edx, 0x4e021004
jge 0x42f230
mov eax, dword [0x438d60]
sub eax, 0x1d0cb76b
cmp eax, 0x4b994672
jge 0x42f230
mov dx, word [0x452e9a]
mov eax, dword [0x44a5c4]
add dword [0x4412d4], ecx
mov eax, dword [0x43d574]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [0x4412d4]
add eax, 0x6247b67c
xor esi, eax
cmp esi, 0x509d7764
push edi
jg 0x42f279
mov ax, word [0x4563de]
cwde
imul eax, eax, 0x8483ad9b
cmp eax, 0x1370f4ea
jg 0x42f279
mov eax, dword [0x43e208]
add eax, 0xf8a67941
xor dword [0x445e5c], eax
add dword [0x44d904], 0xd0cae19d
add dword [0x441380], ecx
mov ecx, dword [0x441380]
mov edi, dword [0x441394]
imul ecx, ecx, 0x4276d736
mov eax, dword [ebp + 0xc]
and edi, ecx
lea esi, [edx + eax*4]
mov eax, dword [ebp + 0x10]
and edi, 0xc613be26
mov dword [0x441394], edi
cmp edx, esi
je 0x42f34c
push ebx
mov edi, 0xabbb7e2c
add dword [0x444664], 0x6009405
xor dword [edx], eax
movzx ecx, word [0x453fa2]
movzx ebx, word [0x4539d2]
movsx ecx, cx
imul ecx, ecx, 0x6e8f9000
sub ebx, ecx
mov word [0x4539d2], bx
movzx ecx, word [0x4562c0]
movsx ecx, cx
ror eax, 4
mov dword [ebp + 8], eax
not ecx
add ecx, 0x3f6b1c35
xor dword [0x4452f8], ecx
mov cl, byte [ebp + 8]
xor dword [0x446454], 0xffeab67c
shr eax, 8
add al, cl
add cl, al
mov byte [ebp + 9], al
mov dword [0x440fa8], edi
mov byte [ebp + 8], cl
mov ecx, dword [0x43a1bc]
mov eax, 0xb63871f
sub eax, ecx
or dword [0x43dfcc], eax
mov eax, dword [ebp + 8]
add edx, 4
cmp edx, esi
jne 0x42f2c0
pop ebx
add dword [0x43f3cc], 0xebe90af4
pop edi
pop esi
pop ebp
ret
Function at 0x40d8f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40d942
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40d911
jmp 0x40d942
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40d932
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40e865
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40e89a
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40e8c4
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40e8c4
test edi, edi
je 0x40e891
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40e891
test edi, edi
je 0x40e8cc
mov eax, edi
jmp 0x40e893
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40e893
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0041240a
add esp, 0xc
int3
Function at 0x41243e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestIntegerRange.exe_gMozillaPoisonSize], eax
call fcn.0040e865
pop ecx
mov ecx, dword [sym.TestIntegerRange.exe_gMozillaPoisonSize]
mov dword [sym.TestIntegerRange.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x412476
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestIntegerRange.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0xecd45a9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6c81490b
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x100010d0
Capabilities:
Delete network filter via wfp api
Enumerate network filters via wfp api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0
push 0
push 0xa
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
mov ebx, eax
test ebx, ebx
jne 0x10001236
mov dword [esp + 0x1c], eax
lea ecx, [ecx]
mov esi, dword [eax + 0x10002080]
mov eax, dword [0x1000300c]
mov edi, dword [esp + 0xc]
test eax, eax
jne 0x10001153
push str.RtlZeroMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1000300c], eax
test eax, eax
je 0x1000115c
push 0x30
lea ecx, [esp + 0x24]
push ecx
call eax
movdqu xmm0, xmmword [esi]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x38], 1
push eax
push edi
movdqu xmmword [esp + 0x30], xmm0
mov dword [esp + 0x44], 2
mov dword [esp + 0x54], 0xffffffff
call dword [sym.imp.fwpuclnt.dll_FwpmFilterCreateEnumHandle0]
mov ebx, eax
test ebx, ebx
jne 0x10001236
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push dword [esp + 0x24]
push dword [esp + 0x1c]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterEnum0]
mov ebx, eax
test ebx, ebx
jne 0x10001214
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10001214
mov edx, dword [esp + 0x14]
test edx, edx
je 0x10001214
xor esi, esi
test edx, edx
je 0x10001209
mov eax, dword [edi + esi*4]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x100011e6
cmp dword [ecx], 0
jne 0x10001204
push dword [eax + 0x8c]
push dword [eax + 0x88]
push dword [esp + 0x14]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterDeleteById0]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc esi
cmp esi, edx
jb 0x100011d7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.fwpuclnt.dll_FwpmFreeMemory0]
push dword [esp + 0x18]
push dword [esp + 0x10]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterDestroyEnumHandle0]
mov eax, dword [esp + 0x1c]
add eax, 4
mov dword [esp + 0x1c], eax
cmp eax, 8
jb 0x10001120
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10001245
push eax
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret