joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d040
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
push esi
push edi
lea eax, [esp + 8]
push eax
mov esi, ecx
mov dword [esp + 0xc], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
shrd ecx, eax, 1
shr eax, 1
test eax, eax
ja 0x40d07b
jb 0x40d076
cmp ecx, 0x7fffffff
ja 0x40d07b
mov dword [esi + 0xc], ecx
jmp 0x40d082
mov dword [esi + 0xc], 0x7fffffff
mov ecx, dword [esi + 0x4dc]
mov edx, dword [ecx + 0x10c]
neg edx
sbb edx, edx
and edx, 0x36b3d972
add edx, 0x18e6fdb
mov dword [esi + 0x380], edx
xor eax, eax
lea ecx, [esi + 0x35c]
lea esp, [esp]
mov word [ecx], ax
inc eax
add ecx, 2
cmp eax, 0x10
jl 0x40d0b0
mov ecx, dword [esi + 0x4dc]
lea edx, [esi + 0x3a0]
mov byte [esi + 0x37c], 1
mov word [esi + 0x388], 0xffff
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
mov ecx, dword [esi + 0x4dc]
mov eax, dword [ecx]
lea edi, [ecx + 0x130]
call dword [eax + 8]
mov dword [edi], eax
mov dword [esi + 0x3c8], edi
pop edi
mov eax, 1
pop esi
add esp, 0x40
ret

Function at 0x40f560
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x426c98]
push ebx
push esi
xor esi, esi
test eax, eax
push edi
jne 0x40f59d
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x40f593
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x426c94], eax
mov dword [0x426c98], 1
mov eax, dword [0x426c94]
test eax, eax
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x40f5ba
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x40f5f5
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
jne 0x40f5ea
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [esp + 0x14]
jns 0x40f5dc
mov ecx, dword [eax + 8]
push ecx
call dword [eax]
jmp 0x40f5e3
mov edx, dword [eax + 0xc]
push edx
call dword [eax + 4]
test eax, eax
je 0x40f5fd
mov dword [ebp], eax
push edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x40fbd0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x426c80]
push edi
xor edi, edi
test eax, eax
je 0x40fbe7
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x426c88]
test eax, eax
je 0x40fbf9
mov eax, 1
pop edi
ret 4
mov eax, dword [0x426c80]
test eax, eax
push esi
jne 0x40fc0c
call fcn.0040f9e0
test eax, eax
je 0x40fc4e
mov eax, dword [0x426ca8]
test eax, eax
mov esi, dword [0x4263a4]
jne 0x40fc38
push str.ActivateActCtx
push 0x426c9c
push 0x418d4c
call fcn.0040f560
test eax, eax
mov dword [0x426ca8], eax
je 0x40fc4e
mov ecx, dword [esp + 0xc]
push ecx
push esi
call eax
test eax, eax
je 0x40fc4e
pop esi
mov eax, 1
pop edi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x40fc5e
cmp eax, 0x78
jne 0x40fc6d
mov eax, 1
pop esi
mov dword [0x426c88], eax
pop edi
ret 4
pop esi
mov eax, edi
pop edi
ret 4
Function at 0x4105e0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x426cbc]
sub esp, 0x208
test eax, eax
je 0x4105fb
mov eax, 1
add esp, 0x208
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CRLRCVYCORE.DLL
call esi
test eax, eax
mov dword [0x426cbc], eax
jne 0x410668
push 0x208
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x410632
xor eax, eax
pop esi
add esp, 0x208
ret
lea ecx, [esp + 4]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x410628
add eax, 2
push str.CRLRCVYCORE.DLL
push eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
lea edx, [esp + 4]
push edx
call esi
test eax, eax
mov dword [0x426cbc], eax
je 0x410628
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._RCV_ProcessWndProcException
push eax
call esi
mov dword [0x426cd0], eax
mov eax, dword [0x426cbc]
push str._RCV_InitHandler
push eax
call esi
mov ecx, dword [0x426cbc]
push str._RCV_UnInitHandler
push ecx
mov dword [0x426cc4], eax
call esi
mov edx, dword [0x426cbc]
push str._RCV_InitThreadHandler
push edx
mov dword [0x426cc8], eax
call esi
mov dword [0x426ccc], eax
mov eax, dword [0x426cbc]
push str._RCV_ProcessWndProcException
push eax
call esi
mov ecx, dword [0x426cbc]
push str._RCV_ExceptionHandler
push ecx
mov dword [0x426cd0], eax
call esi
mov edx, dword [0x426cbc]
push str._RCV_SetNotificationProc
push edx
mov dword [0x426cd4], eax
call esi
mov ecx, dword [0x426cc4]
test ecx, ecx
mov dword [0x426cd8], eax
je 0x410721
mov ecx, dword [0x426cc8]
test ecx, ecx
je 0x410721
mov ecx, dword [0x426ccc]
test ecx, ecx
je 0x410721
mov ecx, dword [0x426cd4]
test ecx, ecx
je 0x410721
mov ecx, dword [0x426cd0]
test ecx, ecx
je 0x410721
test eax, eax
jne 0x410737
mov eax, dword [0x426cbc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x426cbc], 0
mov ecx, dword [0x426cbc]
xor eax, eax
test ecx, ecx
setne al
pop esi
add esp, 0x208
ret
Function at 0x4107a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x415930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x418ce0
lea ecx, [esi + 8]
mov dword [esp + 0xc], esi
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
push 0x418ce0
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], edi
mov dword [esi + 0xc], edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
push 0x418ce0
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 1
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
push 0x418ce0
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 2
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
push 0x418ce0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 3
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esi + 0x2c]
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_3]
lea ecx, [esi + 0x34]
mov dword [esi + 0x30], edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_3]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x411510
Capabilities:
Get file size
Print debug messages
Read file on windows

Disassembly:
sub esp, 0x14
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x411629
cmp esi, 0xffffffff
je 0x411629
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xe
lea edx, [esp + 0x18]
push edx
push esi
call ebp
test eax, eax
jne 0x411574
push str.Error_reading_welcome_bitmap_file__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0xe]
test eax, eax
jne 0x411588
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xe], eax
cmp dword [esp + 8], 0xe
jne 0x411616
cmp word [esp + 0xc], 0x4d42
jne 0x411616
push ebx
push edi
lea ebx, [eax - 0xe]
push 1
push ebx
call dword [sym.imp.MSVCR71.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4115cf
push str.Out_of_memory_loading_welcome_bitmap_file__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push esi
call ebp
test eax, eax
jne 0x411605
push str.Error_reading_welcome_bitmap_file__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x14
ret
push str.Invalid_welcome_bitmap_file_format__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
xor eax, eax
pop esi
add esp, 0x14
ret
push str.Welcome_bitmap_file_does_not_exist__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x412910
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push eax
mov ecx, 0x426e40
call fcn.00410f80
mov eax, dword [0x426e44]
test eax, eax
jne 0x412934
mov ecx, dword [0x426e64]
mov dword [0x426e44], ecx
mov eax, dword [0x426e40]
test eax, eax
jne 0x412948
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [0x426e40], eax
mov eax, dword [0x426d30]
test eax, eax
jne case.0x412961.0
mov eax, dword [esp + 8]
cmp eax, 7
ja case.0x412961.1
movzx edx, byte [eax + 0x412a08]
jmp dword [edx*4 + 0x412a00]
xor eax, eax
ret
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41953c
push esi
call edi
test eax, eax
jne 0x412986
pop edi
pop esi
ret
push ebx
call eax
mov edx, dword [eax]
push str.crlctlintl.dll
mov ecx, eax
call dword [edx + 0x3c]
push str.IsCurLangFarEast
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x4129aa
mov dword [0x426e3c], eax
jmp 0x4129b1
call eax
mov dword [0x426e3c], eax
mov eax, dword [0x426e40]
push 0
push 0x4126f0
push eax
push 0x6d47
push ebx
call fcn.00411640
test eax, eax
mov dword [0x426d30], eax
pop ebx
je 0x4129fd
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x426d30]
push 0
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [0x426d30]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x426d30]
pop edi
pop esi
ret

Function at 0x412c80
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x414bf4
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4197b8
call fcn.004150d0
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x414c34
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414c34
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x414c4c
cmp eax, 0x20b
je 0x414c39
mov dword [ebp - 0x1c], edi
jmp 0x414c60
cmp dword [ecx + 0x84], 0xe
jbe 0x414c34
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x414c5a
cmp dword [ecx + 0x74], 0xe
jbe 0x414c34
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x429044], 0xffffffff
or dword [0x429048], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x428fcc]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x428fc8]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x429040], eax
call fcn.00415148
call fcn.004151e8
cmp dword [0x426754], edi
jne 0x414cc0
push fcn.004151e8
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.004151d6
push 0x4260ec
push 0x4260e8
call sub.MSVCR71.dll__initterm
push 0x41518c
call fcn.00414f42
mov eax, dword [0x428fc4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x428fc0]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x414d14
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4260e4
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x414d3e
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x414df8
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x414dad
cmp ax, di
je 0x414d54
cmp dword [ebp - 0x20], edi
jne 0x414dad
mov ax, word [esi]
cmp ax, di
je 0x414d69
cmp ax, 0x20
ja 0x414d69
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x414d54
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x414d85
movzx eax, word [ebp - 0x54]
jmp 0x414d88
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.00415468
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x414da5
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x414df2
cmp ax, 0x22
jne 0x414dbe
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x414d3e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0041510b
ret
Function at 0x10001130
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push dword [esp + 0x14]
call fcn.1000e3e0
mov esi, eax
add esp, 4
test esi, esi
jns 0x10001161
push 0x44d
push str.hprof_check.c
push str.fd_0
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.1000e430
mov ebx, eax
add esp, 0xc
mov ecx, ebx
and ecx, edx
cmp ecx, 0xffffffff
jne 0x10001194
push 0x44f
push str.hprof_check.c
push str.Cannot_md_seek___to_end_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, 0x200
jg 0x100011b7
push 0x451
push str.hprof_check.c
push str.__jint_nbytes__512
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0
push 0
push esi
call fcn.1000e430
add esp, 0xc
or eax, edx
je 0x100011e3
push 0x453
push str.hprof_check.c
push str.Cannot_md_seek___to_start_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
lea eax, [ebx + 1]
push eax
call fcn.10016960
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000120f
push 0x456
push str.hprof_check.c
push str.image_NULL
push eax
push 1
call fcn.10005090
add esp, 0x14
push ebp
push ebx
push edi
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
add esp, 0xc
test ebp, ebp
jg 0x1000123c
push 0x45b
push str.hprof_check.c
push str.System_read_failed.
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, ebp
pop ebp
je 0x1000125c
push 0x45d
push str.hprof_check.c
push str.__jint_nbytes_nread
push 0
push 1
call fcn.10005090
add esp, 0x14
push esi
call fcn.1000e010
add esp, 4
test edi, edi
jne 0x10001280
mov eax, dword [esp + 0x14]
push eax
push str.No_file_image:__s_n
call fcn.10002c50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x1001f83c]
mov ecx, dword [eax + 0x10]
mov eax, edi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100012b0
test dl, dl
je 0x100012ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100012b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001290
xor eax, eax
jmp 0x100012b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100012d4
push 0x474
push str.hprof_check.c
push str.strcmp__char_p__gdata__header_0
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esp + 0x14]
push edi
push ebx
push eax
push str.Filename_s__nbytes_d__header__s__n
call fcn.10002c50
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100012f0
sub ecx, edx
lea esi, [ecx + edi]
lea eax, [esi + 1]
sub eax, ecx
sub eax, edi
lea ecx, [esp + eax + 0xb]
mov eax, dword [esi + 1]
mov dword [ecx], eax
push dword [esp + 0xc]
call fcn.1000e2a0
add esp, 4
cmp eax, 4
je 0x10001338
push 0x479
push str.hprof_check.c
push str.idsizesizeof_HprofId_
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esi + 5]
push eax
call fcn.1000e2a0
mov eax, dword [esi + 9]
add esi, 0xd
push eax
call fcn.1000e2a0
mov eax, edi
sub eax, esi
add eax, ebx
push eax
push esi
call fcn.100109c0
push ebx
push eax
push str._d_total_records_found_in__d_bytes_n
call fcn.10002c50
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x20
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100109c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x100109cf
pop dword [ebp - 0x3c]
mov eax, 0x5a8d6539
sub eax, 0x4a8c5b6a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x4fc51d05
add dword [ebp - 0x4c], 0xfe8d2846
mov dword [ebp - 0x48], 0x53cc7110
sub dword [ebp - 0x48], 0x219924cb
mov dword [ebp - 0x44], 0xd7bcf9b5
sub dword [ebp - 0x44], 0x8b70b587
mov dword [ebp - 0x40], 0x524774a7
sub dword [ebp - 0x40], 0x524774a7
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x7107553
add eax, 0x8f11ae9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xcfb9b57a
sub dword [ebp - 0x4c], 0x5b474c24
mov dword [ebp - 0x48], 0xa835414f
add dword [ebp - 0x48], 0x99372026
mov dword [ebp - 0x44], 0xc1f1e8bd
sub dword [ebp - 0x44], 0x5e827c51
mov dword [ebp - 0x40], 0x1154c690
add dword [ebp - 0x40], 0xeeab3970
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x5fef343b
add eax, 0xb0125bfd
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x377b7
push 0
call eax
mov ecx, 0x4b8b
mov esi, eax
mov edi, 0x619a50f8
sub edi, 0x519828f8
add edi, dword [ebp - 0x3c]
mov ebx, 0xcb3c7632
add ebx, 0x182a1ae9
mov dword [ebp - 4], 0x37a453d6
mov edx, dword [edi]
mov dword [ebp - 0x1c], 0x52d3c91e
xor edx, ebx
sub dword [ebp - 0x38], 0xe7f8df43
mov dword [esi], edx
sub dword [ebp - 0x18], 0x7c89c403
add esi, 4
add edi, 0xad48e3fd
add edi, 0x52b71c07
loop 0x10010aeb
add eax, 0x120ff
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbf307531
add ecx, 0x50cf8acf
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x10069281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10069290
pop dword [ebp - 0x10]
mov eax, 0x10069290
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3649e
push 0
mov eax, 0x1a4cd4cd
sub eax, 0xa4555a5
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xb0589008
sub ecx, 0xb0584b7b
mov edx, eax
mov edi, 0xfd24be6c
add edi, 0x12e36f94
add edi, dword [ebp - 0x10]
mov esi, 0xb24d8d9d
add esi, 0x52692d5d
add dword [ebp - 8], 0xd4f94c28
mov ebx, dword [edi]
mov dword [ebp - 4], 0x116d34c2
xor ebx, esi
mov dword [ebp - 8], 0x509e2e17
mov dword [edx], ebx
mov dword [ebp - 8], 0x1143b151
add edx, 4
add edi, 4
loop 0x100692ea
add eax, 0x10507
mov ebx, eax
add eax, 0x71131437
add eax, 0x8eecebce
mov ecx, sym.mozglue.dll_Ordinal_0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x15966539
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x53616702
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e020040
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e020040
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e020040
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e020040
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e020040
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e020040
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8