joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000efc0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [esp + 0x18], eax
mov al, byte [0x1007a230]
test al, 1
je 0x1000f184
xor esi, esi
dec esi
mov ecx, 0xfffffff7
lea ebx, [esp + 0x10]
mov edi, esi
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
push ebx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push 0x1007b6a0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov esi, dword [0x1007b6ec]
mov edx, dword [0x1007b6e8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], edx
cmp eax, edx
mov edx, ecx
sbb edx, esi
jl 0x1000f03b
mov dword [0x1007b6e8], eax
mov dword [0x1007b6ec], ecx
mov dword [esp], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov esi, 0x1007b6a0
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push ebx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x1007b6ec]
mov esi, dword [0x1007b6e8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp eax, esi
mov edx, ecx
sbb edx, ebx
jl 0x1000f084
mov dword [0x1007b6e8], eax
mov dword [0x1007b6ec], ecx
mov esi, eax
mov ebx, ecx
push 0x1007b6a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esi, dword [esp]
sbb ebx, dword [esp + 0xc]
mov eax, esi
mov ecx, 0x3e8
mul ecx
imul ecx, ebx, 0x3e8
add ecx, edx
mov esi, dword [esp + 4]
cmp eax, esi
mov edx, ecx
sbb edx, edi
cmovb edi, ecx
cmovb esi, eax
mov ecx, dword [esp + 8]
test ecx, ecx
lea ebx, [esp + 0x10]
je 0x1000f0ce
inc ecx
mov eax, esi
or eax, edi
jne 0x1000eff2
xor eax, eax
inc eax
xor ecx, ecx
mov edx, esi
or edx, edi
cmovne ecx, edi
cmovne eax, esi
mov esi, dword [0x1007a22c]
mov edx, dword [0x1007a228]
mov dword [esp], edx
mov dword [esp + 8], esi
mov edx, 0xf4240
mul edx
mov dword [esp + 4], eax
imul ebx, ecx, 0xf4240
add ebx, edx
push esi
mov edi, dword [esp + 4]
push edi
push ebx
push eax
call fcn.1002d8e0
mov ecx, eax
mov esi, edx
xor edx, edx
xor eax, eax
inc eax
cmp dword [esp + 4], edi
sbb ebx, dword [esp + 8]
cmovb ecx, eax
cmovb esi, edx
mov dword [esp + 4], esi
mov dword [0x1007b6cc], esi
mov dword [esp], ecx
mov dword [0x1007b6c8], ecx
mov esi, edx
mov ecx, eax
mov edi, eax
xor edi, dword [esp]
mov ebx, edx
xor ebx, dword [esp + 4]
mov edx, 0xa
mul edx
or ebx, edi
je 0x1000f165
lea edi, [esi + esi*4]
lea edx, [edx + edi*2]
cmp dword [esp], eax
mov edi, dword [esp + 4]
sbb edi, edx
jae 0x1000f13a
mov dword [0x1007b6d0], ecx
mov dword [0x1007b6d4], esi
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.1002cad0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x1007a22c]
mov eax, dword [0x1007a228]
mov ecx, esi
shld ecx, eax, 4
mov dword [esp], eax
shl eax, 4
jmp 0x1000f0ec
Function at 0x1000fe90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [esp + 0x20], eax
mov dword [esi], 0
mov ebx, dword [ecx + 0x3c]
test ebx, ebx
jne 0x1000fece
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1002cad0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, ecx
mov ecx, dword [ecx + 0x4c]
mov dword [edi + 0x4c], 0
test ecx, ecx
jne 0x1000ffac
mov eax, dword [ebx]
mov ecx, dword [eax + 0x20]
mov dword [esp], ecx
call dword [section..00cfg]
mov ecx, ebx
call dword [esp]
xor eax, eax
mov dword [edi + 0x3c], eax
mov ecx, dword [edi + 0x40]
mov dword [edi + 0x40], eax
mov dword [esi], ecx
mov ebx, dword [edi + 0x44]
test ebx, ebx
je 0x1000ff3f
lea eax, [esp + 8]
push 1
push eax
call sym.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::NowUnfuzzed_bool_
add esp, 8
lea eax, [esp + 8]
movsd xmm0, qword [eax + 0x10]
movsd qword [ebx + 0x18], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebx + 8], xmm0
mov ebx, dword [edi + 0x44]
mov dword [edi + 0x44], 0
test ebx, ebx
jne 0x1000ffcb
mov ebx, dword [edi + 0x48]
mov dword [edi + 0x48], 0
test ebx, ebx
jne 0x1000ffb9
mov ebx, dword [edi + 0x60]
mov ecx, dword [edi + 0x64]
mov dword [edi + 0x54], ecx
mov dword [edi + 0x50], ebx
mov eax, dword [edi + 0x58]
mov dword [esp], eax
mov edx, dword [edi + 0x5c]
mov dword [esp + 4], edx
lock cmpxchg8b qword [edi + 0x58]
xor edx, dword [esp + 4]
xor eax, dword [esp]
or eax, edx
jne 0x1000ff59
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x68], eax
xor ecx, ecx
xor ebx, ebx
mov eax, dword [edi + 0x70]
mov dword [esp], eax
mov edx, dword [edi + 0x74]
mov dword [esp + 4], edx
lock cmpxchg8b qword [edi + 0x70]
xor edx, dword [esp + 4]
xor eax, dword [esp]
or eax, edx
jne 0x1000ff82
xor eax, eax
mov dword [edi + 0x7c], eax
mov dword [edi + 0x78], eax
jmp 0x1000feb7
call fcn.10033360
mov ebx, dword [edi + 0x3c]
jmp 0x1000fee2
mov ecx, ebx
call fcn.100333a0
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x1000ff4d
mov ecx, ebx
call fcn.100333a0
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x1000ff3f
Function at 0x10013b70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x1007a860]
mov ecx, dword [0x1007a2f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10013bb6
mov esi, dword [0x1007a85c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002cad0
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
push 0x1007a860
call fcn.1002d432
add esp, 4
cmp dword [0x1007a860], 0xffffffff
jne 0x10013b9e
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x1007a85c], eax
push 0x1007a860
call fcn.1002d432
add esp, 4
jmp 0x10013b9e

Function at 0x10013cf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x1007a86c]
mov ecx, dword [0x1007a2f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x10013d53
push 0x1007a86c
call fcn.1002d432
add esp, 4
cmp dword [0x1007a86c], 0xffffffff
jne 0x10013d53
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x1007a868], eax
push 0x1007a86c
call fcn.1002d432
add esp, 4
mov esi, dword [0x1007a868]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002cad0
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x10013f20
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ebp + 8]
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea ecx, [ebp - 0x18]
mov dword [ecx], edx
mov dword [ebp - 0x20], 0x10036130
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x100140a1
mov esi, dword [ebp - 0x14]
mov ebx, esi
and ebx, 0xfffffffc
push ebx
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov edi, eax
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
mov ebx, edi
push edi
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x10014098
shr esi, 2
mov eax, dword [ebp - 0x14]
shr eax, 2
cmp eax, esi
cmovae eax, esi
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10014098
xor edi, edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], edi
mov eax, dword [ebx + edi*4]
mov dword [ebp - 0x3c], eax
mov ebx, 0x104
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], ebx
add ebx, ebx
mov edi, ebx
mov eax, 0xffffffff
cmovb edi, eax
push edi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x100140b6
mov edi, dword [ebp - 0x38]
push edi
mov dword [ebp - 0x24], esi
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x100140c4
mov esi, eax
cmp eax, edi
je 0x100140cc
inc esi
mov edi, esi
add edi, esi
mov eax, 0xffffffff
cmovb edi, eax
push edi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov ebx, eax
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edi, dword [ebp - 0x24]
push edi
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x100140e8
push edi
call sym.mozglue.dll__aligned_free
add esp, 4
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov esi, dword [eax + edi*4]
mov ecx, dword [ebp - 0x20]
call dword [section..00cfg]
push esi
push ebx
lea eax, [ebp - 0x1c]
push eax
call ecx
add esp, 0xc
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
inc edi
cmp edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
jne 0x10013fb8
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cad0
mov eax, dword [ebp + 8]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x10013ffe
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
jmp 0x10014082
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov esi, edi
cmp eax, 0x7a
je 0x10013fcd
jmp 0x10014021
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov ebx, edi
mov edi, dword [ebp - 0x28]
jmp 0x10014082
Function at 0x10014100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, ecx
mov dword [ecx], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 0
test edx, edx
je 0x10014162
movzx ecx, word [edx]
cmp ecx, 0x5a4d
jne 0x10014162
mov esi, dword [edx + 0x3c]
lea ecx, [edx + esi]
mov dword [eax + 4], ecx
cmp dword [edx + esi], 0x4550
jne 0x10014162
movzx esi, word [ecx + 0x18]
cmp esi, 0x10b
jne 0x10014162
mov esi, dword [ecx + 0x50]
cmp esi, 0x138
jb 0x10014162
add edx, esi
dec edx
mov dword [eax + 8], edx
cmp dword [ecx + 0x74], 2
jb 0x10014162
cmp dword [ecx + 0x80], esi
setae byte [eax + 0xc]
pop esi
pop ebp
ret
Function at 0x100164c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [0x1007b67c]
mov ebx, dword [0x1007b678]
mov eax, ebx
mov edx, ecx
lock cmpxchg8b qword [0x1007b678]
xor edx, ecx
xor eax, ebx
or eax, edx
jne 0x100164c4
mov eax, ebx
mov edx, ecx
pop ebx
pop ebp
ret
Function at 0x1002c220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, ebx
and esi, 0xfffffffc
je 0x1002c2ce
lea eax, [esi - 1]
shr eax, 2
lea ecx, [eax + 1]
test eax, eax
je 0x1002c28b
mov ebx, ecx
and ebx, 0xfffffffe
neg ebx
xor eax, eax
xor edi, edi
nop
rol eax, 5
xor eax, dword [edx + edi]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + edi + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
add edi, 8
add ebx, 2
jne 0x1002c250
jmp 0x1002c28f
xor eax, eax
xor edi, edi
test cl, 1
mov ebx, dword [ebp + 0xc]
je 0x1002c2af
rol eax, 5
xor eax, dword [edx + edi]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp esi, ebx
jae 0x1002c2c9
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
add esi, 1
cmp ebx, esi
jne 0x1002c2b3
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
cmp esi, ebx
jb 0x1002c2b3
jmp 0x1002c2c9

Function at 0x1002d432
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002d441
pop dword [ebp - 0x34]
mov eax, 0x511f30c7
add eax, 0xbee3a37a
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3a438
push 0
mov eax, 0x771e2a99
sub eax, 0x6716b221
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x5418
xor esi, esi
add esi, eax
mov edx, 0x57fdc671
sub edx, 0x47f59871
add edx, dword [ebp - 0x34]
mov edi, 0xc1bef72c
xor dword [ebp - 0x30], 0xd1ed27b4
mov ebx, dword [edx]
add dword [ebp - 0x18], edx
xor ebx, edi
sub dword [ebp - 0x24], 0x4b296105
mov dword [esi], ebx
add dword [ebp - 0x28], 0x9619fa67
add esi, 0x3156758a
add esi, 0xcea98a7a
add edx, 0x493e3b8c
sub edx, 0x493e3b88
loop 0x1002d496
add eax, 0x56402675
add eax, 0xa9c11cbe
xor ebx, ebx
add ebx, eax
add eax, 0x361d2b4e
sub eax, 0x361d2b49
mov ecx, 0x62b1589e
sub ecx, 0x52b1589e
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10031170
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.mozglue.dll_malloc

Function at 0x100316c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x818
mov ebx, dword [ebp + 8]
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
je 0x10031737
lea ebx, [ebp + 0xc]
mov dword [ebp - 0x824], ebx
lea esi, [ebp - 0x820]
mov ecx, esi
call sym.mozglue.dll_protected:_void___thiscall_mozilla::PrintfTarget::constructor_void_
mov dword [esi], 0x1006acc0
lea edi, [ebp - 0x810]
mov dword [esi + 8], edi
mov dword [esi + 0xc], 0x800
mov ecx, esi
push ebx
mov ebx, dword [ebp + 8]
push ebx
call sym.mozglue.dll_public:_bool___thiscall_mozilla::PrintfTarget::vprint_char_const___char__
mov eax, dword [esi + 4]
mov ecx, 0x7ff
cmp eax, ecx
cmovb ecx, eax
mov byte [ebp + ecx - 0x810], 0
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
add esp, 4
cmp eax, 0xfffffffe
je 0x1003179b
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
add esp, 4
push 0x1006dd0c
push eax
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
add esp, 8
test eax, eax
je 0x1003179b
mov esi, eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x810], edi
call fcn.1000b7a0
push edi
push 0
push ebx
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
add esp, 0x18
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cad0
add esp, 0x818
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10031960
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x1006a230]
movups xmmword [esp + 4], xmm0
mov dword [esp], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x10031aa0
mov esi, eax
movaps xmm0, xmmword [0x1006a240]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
sub esp, 0x18
xor edi, edi
test eax, eax
je 0x10031a80
mov ebx, eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sub esp, 4
movaps xmm0, xmmword [0x1006a250]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
test eax, eax
je 0x10031aa4
mov dword [ebp - 0x3c], eax
mov edi, dword [eax + 0x3c]
lea eax, [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sub esp, 4
mov eax, edi
xor edx, edx
div dword [ebp - 0x18]
sub edi, edx
mov dword [ebp - 0x38], edx
lea eax, [edx + 0xf8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
test eax, eax
je 0x10031a65
mov ecx, dword [ebp - 0x38]
mov edi, dword [eax + ecx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cad0
mov eax, edi
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x10031a8c
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10031a7d
Function at 0x10031ab0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, edx
mov esi, ecx
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0
push edx
call sub.version.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10031b5d
mov edi, eax
mov dword [ebp - 0x20], esi
push eax
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
xor eax, eax
push edi
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c], esi
push esi
push edi
xor edi, edi
push edi
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x10031b7d
lea eax, [ebp - 0x18]
mov dword [eax], 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0x10071716
mov esi, dword [ebp - 0x1c]
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
mov edx, esi
je 0x10031ba3
mov eax, dword [ebp - 0x18]
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov esi, dword [ebp - 0x20]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 8], 0
push edx
call sym.mozglue.dll__aligned_free
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cad0
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], ecx
jmp 0x10031b49
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
xor eax, eax
mov esi, dword [ebp - 0x20]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], ecx
mov edx, dword [ebp - 0x1c]
jmp 0x10031b40
xor eax, eax
jmp 0x10031b31

Function at 0x10032330
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1007a860]
mov ecx, dword [0x1007a2f0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100323ac
mov eax, dword [esi + 8]
test eax, eax
jne 0x10032382
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cad0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [0x1007a85c]
mov dword [ebp - 0x38], ecx
mov ebx, dword [esi + 4]
lea edi, [ebx + eax*8]
lea eax, [ebp - 0x34]
push eax
push dword [ebx]
push dword [ebp - 0x38]
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_VirtualProtect]
add ebx, 8
cmp ebx, edi
je 0x10032369
jmp 0x10032391
push 0x1007a860
call fcn.1002d432
add esp, 4
cmp dword [0x1007a860], 0xffffffff
jne 0x10032362
lea edi, [ebp - 0x34]
push edi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [edi + 4]
mov dword [0x1007a85c], eax
push 0x1007a860
call fcn.1002d432
add esp, 4
jmp 0x10032362
Function at 0x100324f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ecx, dword [ecx + 0x34]
test ecx, ecx
je 0x10032576
mov edi, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
and ecx, 0xfffffffc
call fcn.10032580
test al, al
je 0x10032576
mov dword [ebp - 0x10], ebx
push edi
push dword [esi + 0x34]
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x10032576
mov edi, eax
mov ecx, eax
call fcn.10032580
test al, al
je 0x10032576
lea ecx, [esi + 0x18]
mov edx, edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.10011f30
add esp, 8
mov ecx, eax
mov al, 1
test cl, cl
jne 0x10032578
cmp byte [esi + 0x14], 0
jne 0x10032566
mov dword [esi + 0x14], 1
mov dword [esi + 0x10], 0
mov ecx, esi
mov edx, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1000cf60
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10033840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
cmp byte [ecx + 0x38], 0
je 0x10033864
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov edi, eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.kernel32.dll_AcquireSRWLockExclusive]
mov dword [esi + 0x30], edi
mov ebx, dword [esi + 0x58]
mov edi, dword [esi + 0x5c]
mov eax, ebx
mov edx, edi
mov ecx, edi
lock cmpxchg8b qword [esi + 0x58]
xor edx, edi
xor eax, ebx
or eax, edx
jne 0x10033864
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x64]
cmp byte [esi + 0x38], 0
je 0x100338a4
mov dword [esi + 0x30], 0
add esi, 0x18
push esi
mov dword [ebp - 0x10], eax
mov esi, ecx
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
mov eax, dword [ebp - 0x10]
xor ebx, ecx
xor edi, eax
or edi, ebx
sete al
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10033f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 0x58]
mov edi, dword [ecx + 0x5c]
mov eax, ebx
mov edx, edi
mov ecx, edi
mov esi, dword [ebp - 0x10]
lock cmpxchg8b qword [esi + 0x58]
mov ecx, dword [ebp - 0x10]
xor edx, edi
xor eax, ebx
or eax, edx
jne 0x10033f54
mov edx, dword [ebp + 0xc]
mov esi, dword [edx + 0x28]
mov ecx, dword [edx + 0x2c]
cmp esi, ebx
mov eax, ecx
sbb eax, edi
jb 0x10033f51
add esi, dword [edx + 0x20]
adc ecx, 0
mov eax, ebx
mov edx, edi
mov ebx, esi
mov esi, dword [ebp - 0x10]
lock cmpxchg8b qword [esi + 0x58]
mov eax, dword [ebp + 0xc]
jne 0x10033f51
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov eax, dword [ecx + 0x70]
mov dword [ebp - 0x18], eax
mov edi, dword [ecx + 0x74]
mov ebx, eax
add ebx, dword [ebp - 0x14]
mov ecx, edi
adc ecx, 0
mov edx, edi
lock cmpxchg8b qword [esi + 0x70]
mov ecx, dword [ebp - 0x10]
xor edx, edi
xor eax, dword [ebp - 0x18]
or eax, edx
jne 0x10033fa9
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret