joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7d00
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
pop esi
push esi
call fcn.004ac190
push esi
call fcn.004a934d
push esi
call fcn.004ac2de
push esi
call fcn.004af14b
push esi
call fcn.004af165
push esi
call fcn.004ab1ab
add esp, 0x18
pop esi
jmp 0x4a8920
push esi
push edi
push 0x401714
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x402644
push edi
call esi
xor eax, dword [0x5be670]
push 0x402650
push edi
mov dword [0x5c4f20], eax
call esi
xor eax, dword [0x5be670]
push 0x402658
push edi
mov dword [0x5c4f24], eax
call esi
xor eax, dword [0x5be670]
push 0x402664
push edi
mov dword [0x5c4f28], eax
call esi
xor eax, dword [0x5be670]
push 0x402670
push edi
mov dword [0x5c4f2c], eax
call esi
xor eax, dword [0x5be670]
push 0x40268c
push edi
mov dword [0x5c4f30], eax
call esi
xor eax, dword [0x5be670]
push 0x4026a0
push edi
mov dword [0x5c4f34], eax
call esi
xor eax, dword [0x5be670]
push 0x4026b8
push edi
mov dword [0x5c4f38], eax
call esi
xor eax, dword [0x5be670]
push 0x4026d0
push edi
mov dword [0x5c4f3c], eax
call esi
xor eax, dword [0x5be670]
push 0x4026e4
push edi
mov dword [0x5c4f40], eax
call esi
xor eax, dword [0x5be670]
push 0x402704
push edi
mov dword [0x5c4f44], eax
call esi
xor eax, dword [0x5be670]
push 0x40271c
push edi
mov dword [0x5c4f48], eax
call esi
xor eax, dword [0x5be670]
push 0x402734
push edi
mov dword [0x5c4f4c], eax
call esi
xor eax, dword [0x5be670]
push 0x402748
push edi
mov dword [0x5c4f50], eax
call esi
xor eax, dword [0x5be670]
push 0x40275c
push edi
mov dword [0x5c4f54], eax
call esi
xor eax, dword [0x5be670]
mov dword [0x5c4f58], eax
push 0x402778
push edi
call esi
xor eax, dword [0x5be670]
push 0x402798
push edi
mov dword [0x5c4f5c], eax
call esi
xor eax, dword [0x5be670]
push 0x4027b4
push edi
mov dword [0x5c4f60], eax
call esi
xor eax, dword [0x5be670]
push 0x4027d4
push edi
mov dword [0x5c4f64], eax
call esi
xor eax, dword [0x5be670]
push 0x4027e8
push edi
mov dword [0x5c4f68], eax
call esi
xor eax, dword [0x5be670]
push 0x402804
push edi
mov dword [0x5c4f6c], eax
call esi
xor eax, dword [0x5be670]
push 0x402818
push edi
mov dword [0x5c4f74], eax
call esi
xor eax, dword [0x5be670]
push 0x402828
push edi
mov dword [0x5c4f70], eax
call esi
xor eax, dword [0x5be670]
push 0x402838
push edi
mov dword [0x5c4f78], eax
call esi
xor eax, dword [0x5be670]
push 0x402848
push edi
mov dword [0x5c4f7c], eax
call esi
xor eax, dword [0x5be670]
push 0x402858
push edi
mov dword [0x5c4f80], eax
call esi
xor eax, dword [0x5be670]
push 0x402874
push edi
mov dword [0x5c4f84], eax
call esi
xor eax, dword [0x5be670]
push 0x402888
push edi
mov dword [0x5c4f88], eax
call esi
xor eax, dword [0x5be670]
push 0x402898
push edi
mov dword [0x5c4f8c], eax
call esi
xor eax, dword [0x5be670]
pop edi
mov dword [0x5c4f90], eax
pop esi
ret
Function at 0x4a7f28
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x1fc
mov eax, dword [0x5be670]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.004a7f04
push eax
pop edi
pop ecx
test edi, edi
je 0x4a80ca
push ebx
push 3
call fcn.004a86ce
pop ecx
cmp eax, 1
je 0x4a8072
push 3
call fcn.004a86ce
pop ecx
or eax, eax
jne 0x4a7f7c
cmp dword [0x5bf790], 1
je 0x4a8072
cmp esi, 0xfc
je 0x4a80c9
push 0x402584
push 0x314
push 0x5bf798
call fcn.004ad2de
add esp, 0xc
sub ebx, ebx
or eax, eax
jne 0x4a80d8
push 0x104
push 0x5bf7ca
push ebx
mov word [0x5bf9d2], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x2fb
test eax, eax
jne 0x4a7fe4
push 0x4025b8
push esi
push 0x5bf7ca
call fcn.004ad2de
add esp, 0xc
test eax, eax
jne 0x4a80d8
push 0x5bf7ca
call fcn.004af477
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4a802a
push 0x5bf7ca
call fcn.004af477
lea ecx, [eax*2 + 0x5bf754]
mov eax, ecx
sub eax, 0x5bf7ca
push 3
sar eax, 1
push 0x4025e8
sub esi, eax
push esi
push ecx
call fcn.004af490
add esp, 0x14
test eax, eax
jne 0x4a80d8
push 0x4025f0
push 0x314
mov esi, 0x5bf798
push esi
call fcn.004af40b
add esp, 0xc
or eax, eax
jne 0x4a80d8
push edi
push 0x314
push esi
call fcn.004af40b
add esp, 0xc
or eax, eax
jne 0x4a80d8
push 0x12010
push 0x4025f8
push esi
call fcn.004af54e
add esp, 0xc
jmp 0x4a80c9
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
pop esi
or esi, esi
je 0x4a80c9
cmp esi, 0xffffffff
je 0x4a80c9
xor ebx, ebx
push ebx
pop ecx
mov al, byte [edi + ecx*2]
mov byte [ebp + ecx - 0x1f8], al
cmp word [edi + ecx*2], bx
je 0x4a80a2
inc ecx
cmp ecx, 0x1f4
jb 0x4a8089
push ebx
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebp - 5], bl
call fcn.004af380
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a4894
leave
ret
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a9395
int3

Function at 0x4a87e8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
or edi, edi
je 0x4a8840
push ebx
sub ebx, ebx
push esi
push edi
pop esi
cmp word [edi], bx
je 0x4a8814
add esi, 2
cmp word [esi], bx
jne 0x4a8804
add esi, 2
cmp word [esi], bx
jne 0x4a8804
sub esi, edi
add esi, 2
push esi
call fcn.004ac1e7
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4a8835
push esi
push edi
push eax
call fcn.004a48b0
mov ebx, dword [ebp - 4]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop esi
mov eax, ebx
pop ebx
pop edi
leave
ret
Function at 0x4a8ec0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
xor edx, edx
add eax, ecx
push edi
or ebx, ebx
je 0x4a8efc
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4a8ef4
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4a8efe
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4a8ee4
sub eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a8fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4a8fe4
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4a8fff
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x4af54e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5be670]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004a88e2
mov dword [ebp - 0x14], eax
cmp dword [0x5c05b8], edi
jne 0x4af63f
push 0x800
push edi
push 0x402d48
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
or esi, esi
jne 0x4af5cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4af71f
push 0x402d48
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4af71f
push 0x402d60
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
or eax, eax
je 0x4af71f
push eax
call ebx
push 0x402d6c
push esi
mov dword [0x5c05b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x402d7c
push esi
mov dword [0x5c05bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x402d90
push esi
mov dword [0x5c05c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c05c8], eax
or eax, eax
je 0x4af63c
push 0x402dac
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c05c4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4af664
mov eax, dword [ebp - 0x1c]
or eax, eax
je 0x4af657
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4af679
push 4
pop eax
jmp 0x4af721
cmp dword [ebp - 0x14], edi
je 0x4af679
push dword [0x5c05b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4af65e
mov eax, dword [0x5c05c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4af6d7
cmp dword [0x5c05c8], esi
je 0x4af6d7
push eax
call ebx
push dword [0x5c05c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
or ecx, ecx
je 0x4af6d7
test eax, eax
je 0x4af6d7
call ecx
or eax, eax
je 0x4af6cc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
or eax, eax
je 0x4af6cc
test byte [ebp - 8], 1
jne 0x4af6d7
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4af707
mov eax, dword [0x5c05bc]
cmp eax, esi
je 0x4af704
push eax
call ebx
test eax, eax
je 0x4af704
call eax
push eax
pop edi
test edi, edi
je 0x4af704
mov eax, dword [0x5c05c0]
cmp eax, esi
je 0x4af704
push eax
call ebx
or eax, eax
je 0x4af704
push edi
call eax
push eax
pop edi
mov esi, dword [ebp + 0x10]
push dword [0x5c05b8]
call ebx
or eax, eax
je 0x4af71f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4af721
sub eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4894
leave
ret
Function at 0x4b18b0
Capabilities:
Clear file content

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 1
push esi
push esi
push edi
push esi
pop ebx
mov dword [ebp - 8], esi
call fcn.004ae92b
push edx
pop ecx
mov dword [ebp - 0x18], eax
and eax, ecx
add esp, 0x10
mov dword [ebp - 0x14], ecx
cmp eax, 0xffffffff
je 0x4b1938
push 2
push esi
push esi
push edi
call fcn.004ae92b
mov ecx, eax
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4b19cf
jg 0x4b1912
test esi, esi
je 0x4b19cf
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x4b1944
call fcn.004a93f4
mov dword [eax], 0xc
call fcn.004a93f4
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.004b1a8e
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
jl 0x4b196c
jg 0x4b1965
cmp esi, 0x1000
jb 0x4b196c
mov eax, 0x1000
jmp 0x4b196e
mov eax, esi
push eax
push dword [ebp - 0xc]
push edi
call fcn.004add38
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b1995
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4b19b0
jg 0x4b1957
test esi, esi
je 0x4b19b0
jmp 0x4b1957
call fcn.004a93c0
cmp dword [eax], 5
jne 0x4b19aa
call fcn.004a93f4
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.004b1a8e
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4b1a35
or eax, eax
jg 0x4b1a41
jl 0x4b19d9
test esi, esi
jae 0x4b1a41
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004ae92b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
push edi
call fcn.004b14ba
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
push eax
pop ebx
mov eax, edx
push ebx
pop ecx
and ecx, eax
mov dword [ebp - 8], eax
cmp ecx, 0xffffffff
jne 0x4b1a41
call fcn.004a93f4
mov dword [eax], 0xd
call fcn.004a93c0
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x4b1938
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.004ae92b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
xor eax, eax
jmp 0x4b193f
Function at 0x4011a0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x41969c
call fcn.004014e0
push 0x40
push 0x4030a0
push 0x41969c
push 0x41969c
call fcn.00401400
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x40122b
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x404014]
mov ecx, 8
mov esi, eax
mov edi, 0x41971c
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401340
mov ecx, dword [0x404010]
mov edx, dword [0x404014]
push 0x20
push ecx
push edx
call fcn.00401450
mov edi, dword [0x404010]
add esp, 0x14
mov ecx, 8
mov esi, 0x41971c
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4011df
jmp 0x401284
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x404010]
mov ecx, 8
mov esi, eax
mov edi, 0x41971c
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401340
mov ecx, dword [0x404014]
mov edx, dword [0x404010]
push 0x20
push ecx
push edx
call fcn.00401450
mov edi, dword [0x404014]
add esp, 0x14
mov ecx, 8
mov esi, 0x41971c
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40123a
push 0x40
push 0x4030e0
push 0x41969c
push 0x41969c
call fcn.00401400
mov eax, dword [esp + 0x24]
push 0x40
push 0x41969c
push eax
call fcn.00401520
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4012c0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x41973c
call fcn.004014e0
push 0x38
push str.91__
push 0x41973c
push 0x41973c
call fcn.00401400
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x4031d8]
mov edx, dword [0x404018]
push ecx
push 0x1c
push edx
call fcn.00401480
movsx eax, byte [esi + 0x4031d8]
mov ecx, dword [0x40401c]
push eax
push 0x1c
push ecx
call fcn.00401480
push 0x30
push 0x4031a8
push 0x41973c
push edi
call fcn.00401400
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x4012f2
pop edi
pop esi
ret

Function at 0x401340
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x403120
push esi
push 0x4196dc
call fcn.00401400
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x4196dc
call fcn.00401450
push 0x4196dc
push esi
call fcn.00401390
push 0x20
push 0x403150
push esi
push esi
call fcn.00401400
add esp, 0x34
pop esi
ret

Function at 0x401450
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x401472
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x401464
pop ebx
pop esi
ret
Function at 0x401570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
je 0x40158c
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 8], edi
nop
nop
cmp dword [edi], 0x4550
je 0x4015aa
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call ebx
mov esi, eax
mov dword [ebp - 4], esi
nop
nop
nop
nop
nop
test esi, esi
jne 0x4015e2
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call ebx
mov dword [ebp - 4], eax
mov esi, eax
nop
nop
nop
test esi, esi
jne 0x4015f2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
nop
push 0x14
push 0
call dword [sym.imp.KERNEL32_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32_HeapAlloc]
mov ebx, eax
xor eax, eax
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
nop
nop
nop
nop
mov eax, dword [edi + 0x50]
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32_VirtualAlloc]
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push esi
call dword [sym.imp.KERNEL32_VirtualAlloc]
nop
nop
nop
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x54]
mov edi, eax
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
add edx, eax
mov dword [ebx], edx
nop
nop
nop
mov eax, dword [ebx]
mov esi, dword [ebp - 4]
mov dword [eax + 0x34], esi
nop
nop
nop
mov edi, dword [ebp - 8]
push ebx
push edi
push ecx
call fcn.00401710
add esp, 0xc
nop
nop
nop
nop
mov ecx, dword [edi + 0x34]
mov eax, esi
sub eax, ecx
je 0x40169a
push eax
push ebx
call fcn.00401900
add esp, 8
nop
nop
nop
push ebx
call fcn.00401980
add esp, 4
test eax, eax
je 0x4016e1
nop
nop
nop
push ebx
call fcn.004017f0
add esp, 4
nop
nop
nop
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x401705
nop
nop
nop
mov edx, dword [ebx]
mov eax, dword [edx + 0x28]
add eax, esi
je 0x4016e1
nop
nop
nop
nop
nop
push 0
push 1
push esi
call eax
nop
nop
nop
test eax, eax
jne 0x4016fb
nop
nop
nop
push ebx
call fcn.00401b40
add esp, 4
nop
nop
nop
nop
nop
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
mov dword [ebx + 0x10], 1
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401710
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 8], edi
mov cx, word [eax + 0x14]
lea ebx, [ecx + eax + 0x18]
nop
nop
nop
nop
nop
push 0
call dword [sym.imp.KERNEL32_Sleep]
nop
mov edx, dword [esi]
mov dword [ebp - 4], 0
cmp word [edx + 6], 0
jbe 0x4017e4
add ebx, 0x10
jmp 0x401758
mov edi, dword [ebp - 8]
cmp dword [ebx], 0
jne 0x401794
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x38]
test esi, esi
jle 0x4017c7
mov ecx, dword [ebx - 4]
push 4
push 0x1000
add ecx, edi
push esi
push ecx
call dword [sym.imp.KERNEL32_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosd dword es:[edi], eax
jmp 0x4017c7
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, edi
push eax
push ecx
call dword [sym.imp.KERNEL32_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [ebp + 8]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [ebp - 4], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x401755
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401d50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
nop
nop
mov eax, dword [ebp + 0x10]
mov ecx, 0xfe
and eax, 0xff
cdq
idiv ecx
mov ebx, edx
add bl, 8
nop
nop
mov esi, dword [sym.imp.KERNEL32_Sleep]
push 0
call esi
nop
nop
nop
nop
nop
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x401dbc
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0x10], eax
nop
nop
nop
nop
nop
push 0
call esi
nop
nop
push 0
call esi
nop
nop
mov dl, byte [edi]
push 0
xor dl, bl
add dl, bl
mov byte [edi], dl
inc edi
call esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
jne 0x401d8b
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40ac12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40ac56
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40ac25
jmp 0x40ac56
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40ac46
pop esi
pop ebp
ret

Function at 0x40b9ae
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40b9e3
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40ba0d
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40ba0d
test edi, edi
je 0x40b9da
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b9da
test edi, edi
je 0x40ba15
mov eax, edi
jmp 0x40b9dc
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40b9dc
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040e52b
add esp, 0xc
int3
Function at 0x40e55f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestQuickReturn.exe_gMozillaPoisonSize], eax
call fcn.0040b9ae
pop ecx
mov ecx, dword [sym.TestQuickReturn.exe_gMozillaPoisonSize]
mov dword [sym.TestQuickReturn.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40e597
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestQuickReturn.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret