joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp esi, edi
je 0x40b138
push 0xffffffffffffffff
push 0
push edi
call fcn.00409370
mov eax, dword [edi + 0x18]
lea ecx, [esi + 0x90]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
movzx eax, byte [edi + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [edi + 0x29]
mov byte [esi + 0x29], al
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
movzx eax, byte [edi + 0x38]
mov byte [esi + 0x38], al
movzx eax, byte [edi + 0x39]
mov byte [esi + 0x39], al
movzx eax, byte [edi + 0x3a]
mov byte [esi + 0x3a], al
movzx eax, byte [edi + 0x3b]
mov byte [esi + 0x3b], al
movzx eax, byte [edi + 0x3c]
mov byte [esi + 0x3c], al
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
movzx eax, byte [edi + 0x50]
mov byte [esi + 0x50], al
movzx eax, byte [edi + 0x51]
mov byte [esi + 0x51], al
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
movzx eax, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
movzx eax, byte [edi + 0x78]
mov byte [esi + 0x78], al
mov eax, dword [edi + 0x7c]
mov dword [esi + 0x7c], eax
movzx eax, byte [edi + 0x80]
mov byte [esi + 0x80], al
movzx eax, byte [edi + 0x81]
mov byte [esi + 0x81], al
movzx eax, byte [edi + 0x82]
mov byte [esi + 0x82], al
mov eax, dword [edi + 0x88]
mov dword [esi + 0x88], eax
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x8c], eax
lea eax, [edi + 0x90]
cmp ecx, eax
je 0x40b244
push 0xffffffffffffffff
push 0
push eax
call fcn.00409370
mov eax, dword [edi + 0xa8]
mov dword [esi + 0xa8], eax
mov eax, dword [edi + 0xac]
mov dword [esi + 0xac], eax
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x40b2e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x443004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
fld dword [esi]
fldz
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 0x44
jnp 0x40b311
fstp st(0)
fld dword [esi]
fstp dword [ebp - 8]
movzx eax, byte [ebp - 8]
xor eax, 0x811c9dc5
mov edx, dword [ebx + 0x18]
imul ecx, eax, 0x1000193
movzx eax, byte [ebp - 7]
mov ebx, dword [ebx + 0xc]
xor ecx, eax
movzx eax, byte [ebp - 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov ecx, dword [ebx + edx*8]
lea eax, [edx + edx]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov edx, dword [edx + 4]
mov edi, edi
cmp dword [ebx + eax*4], edx
jne 0x40b369
mov eax, edx
jmp 0x40b36f
mov eax, dword [ebx + eax*4 + 4]
mov eax, dword [eax]
cmp ecx, eax
je 0x40b398
fld dword [ecx + 8]
fld dword [esi]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x40b388
mov ecx, dword [ecx]
mov eax, dword [ebp - 8]
jmp 0x40b360
fld dword [esi]
fld dword [ecx + 8]
fucompp
fnstsw ax
test ah, 0x44
jp 0x40b398
mov edx, ecx
mov ecx, dword [ebp - 4]
mov eax, edi
mov dword [edi], edx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041a002
mov esp, ebp
pop ebp
ret 8
Function at 0x40b480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call fcn.00408830
mov eax, dword [esi + 0x18]
lea ecx, [edi + 0x90]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x28]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x29]
mov byte [edi + 0x29], al
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
movzx eax, byte [esi + 0x38]
mov byte [edi + 0x38], al
movzx eax, byte [esi + 0x39]
mov byte [edi + 0x39], al
movzx eax, byte [esi + 0x3a]
mov byte [edi + 0x3a], al
movzx eax, byte [esi + 0x3b]
mov byte [edi + 0x3b], al
movzx eax, byte [esi + 0x3c]
mov byte [edi + 0x3c], al
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
movzx eax, byte [esi + 0x50]
mov byte [edi + 0x50], al
movzx eax, byte [esi + 0x51]
mov byte [edi + 0x51], al
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
movzx eax, byte [esi + 0x6c]
mov byte [edi + 0x6c], al
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
movzx eax, byte [esi + 0x78]
mov byte [edi + 0x78], al
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
movzx eax, byte [esi + 0x80]
mov byte [edi + 0x80], al
movzx eax, byte [esi + 0x81]
mov byte [edi + 0x81], al
movzx eax, byte [esi + 0x82]
mov byte [edi + 0x82], al
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
lea eax, [esi + 0x90]
push eax
call fcn.00408830
mov eax, dword [esi + 0xa8]
mov dword [edi + 0xa8], eax
mov eax, dword [esi + 0xac]
mov dword [edi + 0xac], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x40bb50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4302f0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x443004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
fld dword [edi]
fldz
fucom st(1)
mov dword [ebp - 0x24], ebx
fnstsw ax
fstp st(1)
test ah, 0x44
jnp 0x40bba6
fstp st(0)
fld dword [edi]
fstp dword [ebp - 0x1c]
movzx eax, byte [ebp - 0x1c]
xor eax, 0x811c9dc5
mov edx, dword [ebx + 0x18]
imul ecx, eax, 0x1000193
movzx eax, byte [ebp - 0x1b]
mov esi, dword [ebx + 0xc]
xor ecx, eax
movzx eax, byte [ebp - 0x1a]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x19]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov dword [ebp - 0x1c], edx
mov ecx, dword [esi + edx*8]
cmp ecx, dword [ebx + 4]
jne 0x40bbf4
mov esi, dword [ebx + 4]
jmp 0x40bbfa
mov esi, dword [esi + edx*8 + 4]
mov esi, dword [esi]
cmp esi, ecx
je 0x40bc1d
fld dword [edi]
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
mov esi, dword [esi + 4]
fld st(0)
fld dword [esi + 8]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x40bc64
cmp esi, ecx
jne 0x40bc06
fstp st(0)
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x40bc4d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8]
cmp eax, dword [ebx + 4]
jne 0x40bcab
mov dword [ecx + edx*8], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x40bcd3
mov edi, dword [ebp + 0x10]
fstp st(0)
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0041a013
mov eax, dword [ebp - 0x20]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041a002
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x40bcb4
mov dword [ecx + edx*8], edi
jmp 0x40bcd3
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + edx*8 + 4], eax
cmp eax, edi
je 0x40bcd3
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*8 + 4]
mov eax, dword [eax + 4]
mov dword [edx + ecx*8 + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0040bf80
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x40bc8d
Function at 0x40c020
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x443004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0xc], eax
fld dword [edi + 8]
fldz
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 0x44
jnp 0x40c053
fstp st(0)
fld dword [edi + 8]
fstp dword [ebp - 8]
movzx eax, byte [ebp - 8]
xor eax, 0x811c9dc5
mov edx, dword [ebx + 0x18]
imul ecx, eax, 0x1000193
movzx eax, byte [ebp - 7]
xor ecx, eax
movzx eax, byte [ebp - 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0xc]
and edx, eax
cmp dword [ecx + edx*8 + 4], edi
jne 0x40c0b7
cmp dword [ecx + edx*8], edi
jne 0x40c0ae
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x40c0c1
mov eax, dword [edi + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x40c0c1
cmp dword [ecx + edx*8], edi
jne 0x40c0c4
mov eax, dword [edi]
mov dword [ecx + edx*8], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0041a013
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.0041a002
mov esp, ebp
pop ebp
ret 8

Function at 0x40d200
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, ecx
push edi
cmp byte [esi + 2], 0
je 0x40d23c
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, eax
xor eax, eax
cmp eax, dword [esi + 0x24]
ja 0x40d233
jb 0x40d228
cmp ecx, dword [esi + 0x20]
jae 0x40d233
mov eax, dword [esi + 0x20]
sub eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi + 1], al
je 0x40d27b
call edi
jmp 0x40d248
cmp byte [esi + 1], 0
je 0x40d27b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
sub eax, dword [esi + 0x18]
push ecx
push dword [esi + 0x14]
sbb ecx, dword [esi + 0x1c]
push ecx
push eax
call fcn.0042ecd0
mov edi, dword [esi + 0x10]
xor ecx, ecx
add edi, dword [esi + 8]
adc ecx, dword [esi + 0xc]
cmp edx, ecx
jb 0x40d270
ja 0x40d27b
cmp eax, edi
jae 0x40d27b
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x443004]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0xa8], 0
jne 0x414699
push 0xe2
push str.....CommonCommon.cpp
push str._pRandomDataWriteBuffer___nullptr
call fcn.0042231d
add esp, 0xc
mov edi, dword [ebx + 0x88]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov byte [esp + 0x13], 1
call fcn.0040d3b0
cmp dword [eax + 0x14], 0x10
lea edx, [eax + 0x10]
jb 0x4146bb
mov eax, dword [eax]
mov edx, dword [edx]
mov ecx, eax
push 0
push 0x437d74
call fcn.004091e0
mov esi, eax
add esp, 8
mov eax, dword [esp + 0x2c]
cmp eax, 0x10
jb 0x4146e4
inc eax
push eax
push dword [esp + 0x1c]
call fcn.00401970
test esi, esi
jne 0x414727
test edi, edi
je 0x414829
call fcn.00420963
and eax, 0x800000ff
jns 0x414703
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [ebx + 0xa8]
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jb 0x4146f0
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0041a002
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.0040d3b0
cmp dword [eax + 0x14], 0x10
jb 0x41473b
mov eax, dword [eax]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov dword [esp + 0x10], edx
cmp ecx, 0x10
jb 0x41476f
inc ecx
push ecx
push dword [esp + 0x1c]
call fcn.00401970
mov edx, dword [esp + 0x10]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
cmp edx, 0xffffffff
je 0x41483f
mov eax, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
mov esi, dword [ebx + 0xa8]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4147ad
test edi, edi
je 0x4147ed
test eax, eax
jb 0x4147c0
ja 0x4147b9
cmp edi, 0x10000
jbe 0x4147c0
mov eax, 0x10000
jmp 0x4147c2
mov eax, edi
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
mov eax, dword [esp + 0x30]
jne 0x4147eb
test eax, eax
je 0x4147eb
mov edx, dword [esp + 0x10]
add esi, eax
mov eax, dword [esp + 0x14]
jmp 0x4147a3
add esi, eax
mov ecx, dword [ebx + 0x88]
xor edi, edi
mov edx, dword [ebx + 0xa8]
add ecx, edx
mov eax, ecx
sub eax, esi
cmp ecx, esi
sbb ecx, ecx
not ecx
and ecx, eax
jbe 0x41481f
jmp 0x414810
mov al, byte [edx]
lea edx, [edx + 1]
inc edi
mov byte [esi], al
lea esi, [esi + 1]
cmp edi, ecx
jb 0x414810
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0041a002
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x34]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041a002
mov esp, ebp
pop ebp
ret
Function at 0x416020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430d48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x443004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.004081b0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x24]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x21], al
lea eax, [esi + 0x24]
push eax
call fcn.00408710
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
movzx eax, byte [esi + 0x31]
mov byte [edi + 0x31], al
movzx eax, byte [esi + 0x32]
mov byte [edi + 0x32], al
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41ff64
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
call fcn.0041fd66
inc ebx

Function at 0x41ff74
Capabilities:
Enumerate pe sections

Disassembly:
inc ebx
adc cl, byte [ebx - 0x24ccefbb]
cmp eax, ebx
je 0x420581
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
cmp byte [eax], bl
mov dword [ebp - 0x44], esi
call fcn.0041fd88
aam 0xc2
push edx
fisttp dword [edi]
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0041fd88
and al, dh
leave
movsd dword es:[edi], dword [esi]
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x41ffe2
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x41ffdc
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x41ffcd
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0041fd88
add esp, esi
xchg ebp, eax
pop ecx
lea eax, [ebp - 0x58]
Function at 0x420137
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.0041fd4d
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0041fd98
push eax
push esi
push dword [ebp + 8]
call fcn.0041fd4d
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
inc ebp
loop 0x420233
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041fd98
push eax
push esi
push dword [ebp + 8]
call fcn.0041fd4d
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041fd88
fiadd dword [ecx - 0x62775983]
jl 0x42020d
invalid
invalid

Function at 0x4204b2
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x42045f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x42047d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4204db
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
adc byte [eax], al
add byte [eax], al
invalid
adc byte [eax], al
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4204c2
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4204cb
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4204d5
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4204b7
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x420441
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x4205df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [edx - 0x3a]
test dword [esi + 0x46fffffc], esi
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0041fd98
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041fd4d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
invalid
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]

Function at 0x427e1b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427adb
Function at 0x4010b3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x4031b4
cmp dword [edi], ebx
je 0x401158
push str._mozilla.org_observer_service_1
mov edx, 0x403594
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.00401b5b
mov eax, dword [ebp - 4]
test eax, eax
je 0x401138
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_qm
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_telemetry
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00401c48
mov eax, dword [ebp - 4]
test eax, eax
je 0x401158
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40118f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x40118f
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.004017de
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.00401898
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4011ab
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4011b8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x4011c4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4011d4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret