joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a010
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040eaf0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41a0db
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41a0db
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41a08e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41a099
or bh, 8
and edi, 0x8000000
je 0x41a0b4
mov eax, dword [0x43b15c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41a0db
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a4b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41a4db
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41a4ff
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41a51a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x41a714
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ffd8]
jne 0x41a725
test ecx, 0xffff0000
jne 0x41a725
ret
jmp fcn.0041a72a
Function at 0x41e00b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41e04d
call fcn.00421e22
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [0x430040]
cmp eax, edi
je 0x41e04d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41e044
xor eax, eax
jmp 0x41e055
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041e05b
pop edi
pop esi
pop ebx
ret 4

Function at 0x420783
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4207be
invalid
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4207a5
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4207b6
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4207c0
inc edi
add eax, 0x28
cmp edi, esi
jb 0x42079b
xor eax, eax
pop edi
pop esi
ret

Function at 0x420b47
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cmpsb byte [esi], byte es:[edi]
inc ecx
call fcn.00420753
push eax
push esi
push dword [ebp + 8]
call fcn.00420708
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
invalid
inc ebp
invalid

Function at 0x420dd1
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x420df7
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x420df2
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x420ddc
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x420de4
cmp edx, ebx
jne 0x420f32
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x420db3
add eax, dword [eax + 4]
jmp 0x420da0
mov dword [ebp + 0xc], ebx
jmp 0x420e02
Function at 0x420e46
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x420e1a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x420e38
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x420e96
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x420e7d
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x420e86
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x420e90
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x420e72
inc dword [ebp + 0xc]
invalid
test dword [eax - 1], edi
invalid

Function at 0x4221c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
lodsb al, byte [esi]
clc
invalid
jmp dword [edi - 0x7527a3a]
invalid
dec dword [eax - 0x7517a3a]
invalid
inc dword [edx - 0x7507a3a]
invalid
call dword [esi - 0x74f7a3a]
invalid
dec dword [eax - 0x74e7a3a]
invalid
dec dword [ecx - 0x74d7a3a]
invalid
dec dword [ebp - 0x74c7a3a]
invalid
call ebp
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.00420753
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.00420753
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.004206b4
add esp, 0xc
lea eax, [ebp - 0x504]
test esp, edi
cli
invalid
dec dword [ecx - 0x39f7b]
invalid
jmp 0x4226bb

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10013a33
pop dword [ebp - 0x48]
mov eax, 0xcdf74f0f
add eax, 0x4209eb24
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xb3973ff9
sub dword [ebp - 0x58], 0x6544faae
mov dword [ebp - 0x54], 0xb9565edc
sub dword [ebp - 0x54], 0x87231297
mov dword [ebp - 0x50], 0x7b981557
add dword [ebp - 0x50], 0xd0b42ed7
mov dword [ebp - 0x4c], 0xfa5df84b
add dword [ebp - 0x4c], 0x5a207b5
lea eax, [ebp - 0x58]
push eax
mov eax, 0xd9ee5079
sub eax, 0xc9ec8ff9
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x85a4b96e
add dword [ebp - 0x58], 0xeecdafe8
mov dword [ebp - 0x54], 0x73d94de9
add dword [ebp - 0x54], 0xcd93138c
mov dword [ebp - 0x50], 0x6d92df97
add dword [ebp - 0x50], 0xf5dc8cd5
mov dword [ebp - 0x4c], 0x3baa325b
sub dword [ebp - 0x4c], 0x3baa325b
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x73fc5423
add eax, 0x9c056bdd
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3719d
push 0
call eax
mov ecx, 0xe6d0cccd
sub ecx, 0xe6d0860b
xor edi, edi
add edi, eax
mov ebx, 0x5b2a5ff2
add ebx, 0xb4d8080e
add ebx, dword [ebp - 0x48]
mov esi, 0x213c2c96
sub esi, 0x2d792aca
xor dword [ebp - 8], 0xe4c38628
mov edx, dword [ebx]
xor edx, esi
xor dword [ebp - 0x40], 0xbcbe1a04
mov dword [edi], edx
xor dword [ebp - 0x18], ebx
add edi, 4
add ebx, 0xaa9b969e
sub ebx, 0xaa9b969a
loop 0x10013b57
add eax, 0xba3f805b
add eax, 0x45c18d80
mov ebx, eax
add eax, 0x63788832
sub eax, 0x6378882d
mov ecx, 0xbd64c638
add ecx, 0x529b39c8
add ecx, dword [ebp - 0x48]
invalid
Function at 0x405ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov ax, word [0x4013fc]
push ebx
push esi
push edi
mov word [ebp - 0x28c], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x28a]
rep stosd dword es:[edi], eax
xor esi, esi
push esi
mov dword [ebp - 0xc], esi
stosw word es:[edi], ax
mov dword [ebp - 0x10], esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x40613b
push 0x4013ec
push esi
call fcn.004092a5
push eax
call fcn.0040762e
jmp 0x40f818
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub word [edx + 0x413ffe], 0x2d01
xor ecx, edi
xor ecx, ebp
mov al, ch
jmp 0x40f718
xchg ah, ch
xchg ecx, ecx
not ecx
adc eax, ebp
test cl, 0xac
nop
not al
dec ecx
sub edx, 2
not eax
jmp 0x40f63a
not ecx
xchg ecx, eax
jg 0x40f286
cmp eax, 0x7356fc75
jmp loc.00418d74
sbb al, 0x88
nop
add ecx, 0xa06380ec
mov ecx, ebx
sub ch, 0x11
mov eax, ecx
jmp 0x40f50d
adc al, dl
xchg ecx, ecx
mov al, 0x4b
mov ecx, ebp
lea ecx, [edi + ebp*2 - 0x77532ec5]
mov edx, 0x4e96
clc
mov ecx, esp
not eax
jmp 0x40f286

Function at 0x40618c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov esi, ecx
push dword [esi + 4]
mov dword [esi], 0x401400
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x406207
push 0xffffffffffffffeb
push dword [esi + 4]
call fcn.0040942a
cmp esi, eax
jne 0x406207
push 0
push 0xffffffffffffffeb
push dword [esi + 4]
call fcn.00409ca4
and byte [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push 0x100
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x10c]
push 1
mov dword [ebp - 8], ecx
pop eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push ecx
push eax
push 0x4000000
push 0x30357864
call fcn.0040ac4a
add esp, 0x10
pop esi
leave
ret
Function at 0x45c8b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x33000]
push edi
or ebp, 0xffffffff
jmp 0x45c8d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c8d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c8c8
mov eax, 1
add ebx, ebx
jne 0x45c8eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c8e0
jne 0x45c8fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c8e0
xor ecx, ecx
sub eax, 3
jb 0x45c910
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c982
mov ebp, eax
add ebx, ebx
jne 0x45c91b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45c928
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45c94c
inc ecx
add ebx, ebx
jne 0x45c938
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c92d
jne 0x45c949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c92d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c96c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c95d
jmp 0x45c8ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c96c
add edi, ecx
jmp 0x45c8ce
pop esi
mov edi, esi
mov ecx, 0x1e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c98a
cmp byte [edi], 0
jne 0x45c98a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c98f
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45c9fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c2d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45c9bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c2dc]
or eax, eax
je 0x45c9f8
mov dword [ebx], eax
add ebx, 4
jmp 0x45c9d9
call dword [esi + 0x5c2d8]
mov ebp, dword [esi + 0x5c2e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45ca32
sub esp, 0xffffff80
jmp 0x401730
Function at 0x40d1aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40d1f4
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40d1c3
jmp 0x40d1f4
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40d1e4
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40e117
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40e14c
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40e176
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40e176
test edi, edi
je 0x40e143
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40e143
test edi, edi
je 0x40e17e
mov eax, edi
jmp 0x40e145
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40e145
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00411cbc
add esp, 0xc
int3
Function at 0x411cf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestMaybe.exe_gMozillaPoisonSize], eax
call fcn.0040e117
pop ecx
mov ecx, dword [sym.TestMaybe.exe_gMozillaPoisonSize]
mov dword [sym.TestMaybe.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x411d28
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMaybe.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x49d8d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x62000]
lea eax, [edi + 0x90350]
push dword [eax]
mov dword [eax], 0x258055e1
push eax
push edi
jmp 0x49d8fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49d901
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d8f0
mov eax, 1
add ebx, ebx
jne 0x49d913
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49d924
jne 0x49d943
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d943
dec eax
add ebx, ebx
jne 0x49d930
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49d908
add ebx, ebx
jne 0x49d93f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49d995
xor ecx, ecx
sub eax, 3
jb 0x49d95b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49d9ca
sar eax, 1
mov ebp, eax
jmp 0x49d966
add ebx, ebx
jne 0x49d966
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d934
inc ecx
add ebx, ebx
jne 0x49d974
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49d934
add ebx, ebx
jne 0x49d981
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49d976
jne 0x49d992
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49d976
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49d9b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49d9a6
jmp 0x49d8f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49d9b4
add edi, ecx
jmp 0x49d8f6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x3843
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49d9d6
cmp byte [edi], 0x11
jne 0x49d9d6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49d9db
lea edi, [esi + 0x98000]
mov eax, dword [edi]
or eax, eax
je 0x49da53
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9d1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9d2b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49da08
mov ecx, edi
jns 0x49da37
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9d2bc]
or eax, eax
je 0x49da4d
mov dword [ebx], eax
add ebx, 4
jmp 0x49da25
call dword [esi + 0x9d2b8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x49da84
cmp al, 0xef
ja 0x49da77
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x49da59
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x49da66
mov ebp, dword [esi + 0x9d2c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49dab8
sub esp, 0xffffff80
jmp 0x437689
Function at 0x405c3b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x405c5c
jl 0x405c53
test edi, edi
jne 0x405c5c
xor eax, eax
xor edx, edx
jmp 0x405d1d
cmp dword [ebx + 0x38], 0
je 0x405c71
push eax
push edi
push dword [ebp + 8]
call fcn.00405d23
jmp 0x405d1d
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x405cb8
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x405cb8
cmp eax, edi
jb 0x405c92
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.004071f0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x405cbe
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x405d12
mov ecx, ebx
call fcn.0040548b
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x405cfd
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040c47f
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x405d12
jmp 0x405cd0
test edx, edx
je 0x405d12
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040c47f
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40703c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40707b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40707b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40707b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40707b
cmp dword [ecx + 0x74], 0xe
jbe 0x40707b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41110f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4213f0
push 0x4213e8
push str.FlsAlloc
push 0x1f
call fcn.00410f7a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411143
push dword [ebp + 8]
mov ecx, esi
call dword [0x41e130]
call esi
jmp 0x411149
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41118d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x421400
push 0x4213f8
push str.FlsGetValue
push 0x21
call fcn.00410f7a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4111c4
push dword [ebp + 8]
mov ecx, esi
call dword [0x41e130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4111cc
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x421408
push 0x421400
push str.FlsSetValue
push 0x22
call fcn.00410f7a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411206
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41e130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]