joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d7fe0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010e758
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], 0
push 2
push 0x10120a24
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], edi
mov esi, edx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.1000d690
mov dword [ebp - 4], 0
cmp dword [0x10154808], 0
jne 0x100d809f
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x100d8047
xor ecx, ecx
jmp 0x100d8059
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d8050
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.1000c6b0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jae 0x100d8113
mov eax, dword [ebp - 0x1c]
add eax, 1
je 0x100d8118
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.100ebbe0
mov ecx, dword [ebp - 0x18]
add esp, 0xc
jmp 0x100d8118
push 0xffffffffffffffff
push 0
push 0x101547f8
lea ecx, [ebp - 0x2c]
call fcn.1000c820
mov edx, dword [esi]
cmp byte [edx], 0
jne 0x100d80bb
xor ecx, ecx
jmp 0x100d80cb
mov ecx, edx
push ebx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d80c1
sub ecx, ebx
pop ebx
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.1000c6b0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x100d8063
mov edx, dword [esi]
mov esi, 2
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov al, byte [edx]
cmovae ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], al
cmp byte [edx], 0
je 0x100d8063
inc esi
inc edx
jmp 0x100d80f6
mov eax, dword [ebp - 0x2c]
mov dword [edi], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [edi + 0x14], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100d8dd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [esp + 0xc], edi
jb 0x100d8deb
mov esi, dword [ebx]
jmp 0x100d8ded
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100d8e09
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100d8df8
mov ecx, dword [0x10155338]
and ecx, edx
mov edx, dword [0x1015532c]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [esp + 0x10], esi
lea ecx, [edx + ecx*4]
mov dword [esp + 0x14], ecx
nop dword [eax + eax]
mov edx, dword [0x10155324]
cmp esi, edx
jne 0x100d8e3e
mov ecx, edx
jmp 0x100d8e42
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100d8f87
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x100d8e57
mov edi, dword [ebx]
jmp 0x100d8e59
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x100d8e64
mov edx, dword [edx]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov esi, ecx
cmp dword [esp + 0x20], ecx
cmovb esi, dword [esp + 0x20]
test esi, esi
je 0x100d8ed6
sub esi, 4
jb 0x100d8e93
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x100d8e98
add edx, 4
add edi, 4
sub esi, 4
jae 0x100d8e82
cmp esi, 0xfffffffc
je 0x100d8ecc
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x100d8ec5
cmp esi, 0xfffffffd
je 0x100d8ecc
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x100d8ec5
cmp esi, 0xfffffffe
je 0x100d8ecc
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x100d8ec5
cmp esi, 0xffffffff
je 0x100d8ecc
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x100d8ecc
sbb ecx, ecx
or ecx, 1
jmp 0x100d8ece
xor ecx, ecx
test ecx, ecx
jne 0x100d8ee0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jb 0x100d8ee0
jbe 0x100d8eef
mov eax, dword [eax]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x100d8e30
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x100d8efd
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x100d8f05
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ecx, edi
mov esi, edi
cmovb esi, ecx
test esi, esi
je 0x100d8f6b
sub esi, 4
jb 0x100d8f28
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x100d8f2d
add ebx, 4
add edx, 4
sub esi, 4
jae 0x100d8f17
cmp esi, 0xfffffffc
je 0x100d8f61
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x100d8f5a
cmp esi, 0xfffffffd
je 0x100d8f61
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x100d8f5a
cmp esi, 0xfffffffe
je 0x100d8f61
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x100d8f5a
cmp esi, 0xffffffff
je 0x100d8f61
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x100d8f61
sbb ecx, ecx
or ecx, 1
jmp 0x100d8f63
xor ecx, ecx
test ecx, ecx
jne 0x100d8f71
mov ecx, dword [esp + 0xc]
cmp ecx, edi
jb 0x100d8f71
jbe 0x100d8f76
mov eax, dword [0x10155324]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [eax], edx
add esp, 0xc
ret 8
Function at 0x100d9bb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
mov bl, byte [0x1013d3a8]
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 1
push 0x459d4b
call esi
lea eax, [esp + 8]
mov byte [0x459d4b], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459d4b
call esi
mov bl, byte [0x1013d3a8]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459e3b
call esi
lea eax, [esp + 8]
mov byte [0x459e3b], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459e3b
call esi
mov bl, byte [0x1013d3a8]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459eeb
call esi
lea eax, [esp + 8]
mov byte [0x459eeb], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459eeb
call esi
mov bl, byte [0x1013d3a8]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x459f9f
call esi
lea eax, [esp + 8]
mov byte [0x459f9f], bl
push eax
push dword [esp + 0xc]
push 1
push 0x459f9f
call esi
mov bl, byte [0x1013d3a8]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x45a053
call esi
lea eax, [esp + 8]
mov byte [0x45a053], bl
push eax
push dword [esp + 0xc]
push 1
push 0x45a053
call esi
mov bl, byte [0x1013d3a8]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x45a10b
call esi
mov byte [0x45a10b], bl
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 1
push 0x45a10b
call esi
mov bl, byte [0x1013d3a8]
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x45ae53
call esi
lea eax, [esp + 8]
mov byte [0x45ae53], bl
push eax
push dword [esp + 0xc]
push 1
push 0x45ae53
call esi
pop esi
pop ebx
pop ecx
ret
Function at 0x100df1f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [esp + 0xc], edi
jb 0x100df20b
mov esi, dword [ebx]
jmp 0x100df20d
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100df229
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100df218
mov ecx, dword [0x10155388]
and ecx, edx
mov edx, dword [0x1015537c]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [esp + 0x10], esi
lea ecx, [edx + ecx*4]
mov dword [esp + 0x14], ecx
nop dword [eax + eax]
mov edx, dword [0x10155374]
cmp esi, edx
jne 0x100df25e
mov ecx, edx
jmp 0x100df262
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100df3a7
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x100df277
mov edi, dword [ebx]
jmp 0x100df279
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x100df284
mov edx, dword [edx]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov esi, ecx
cmp dword [esp + 0x20], ecx
cmovb esi, dword [esp + 0x20]
test esi, esi
je 0x100df2f6
sub esi, 4
jb 0x100df2b3
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x100df2b8
add edx, 4
add edi, 4
sub esi, 4
jae 0x100df2a2
cmp esi, 0xfffffffc
je 0x100df2ec
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x100df2e5
cmp esi, 0xfffffffd
je 0x100df2ec
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x100df2e5
cmp esi, 0xfffffffe
je 0x100df2ec
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x100df2e5
cmp esi, 0xffffffff
je 0x100df2ec
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x100df2ec
sbb ecx, ecx
or ecx, 1
jmp 0x100df2ee
xor ecx, ecx
test ecx, ecx
jne 0x100df300
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jb 0x100df300
jbe 0x100df30f
mov eax, dword [eax]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x100df250
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x100df31d
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x100df325
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ecx, edi
mov esi, edi
cmovb esi, ecx
test esi, esi
je 0x100df38b
sub esi, 4
jb 0x100df348
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x100df34d
add ebx, 4
add edx, 4
sub esi, 4
jae 0x100df337
cmp esi, 0xfffffffc
je 0x100df381
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x100df37a
cmp esi, 0xfffffffd
je 0x100df381
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x100df37a
cmp esi, 0xfffffffe
je 0x100df381
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x100df37a
cmp esi, 0xffffffff
je 0x100df381
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x100df381
sbb ecx, ecx
or ecx, 1
jmp 0x100df383
xor ecx, ecx
test ecx, ecx
jne 0x100df391
mov ecx, dword [esp + 0xc]
cmp ecx, edi
jb 0x100df391
jbe 0x100df396
mov eax, dword [0x10155374]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword [eax], edx
add esp, 0xc
ret 8
Function at 0x100e3fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x45f627
call esi
mov eax, 0x100e3f60
sub eax, 0x45f62b
mov dword [0x45f627], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x45f627
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x426669
call esi
mov eax, 0x100e3fc0
mov byte [0x426669], 0xe8
sub eax, 0x42666e
mov dword [0x42666a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x426669
call esi
pop esi
pop ecx
ret

Function at 0x100e5720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push 1
push 0x100e5050
mov edx, 0x4cafe6
mov cl, 0xe8
call fcn.100120f0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x4cafee
call esi
lea eax, [esp + 4]
mov byte [0x4cafee], 0xe9
push eax
push dword [esp + 8]
push 1
push 0x4cafee
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4cafef
call esi
lea eax, [esp + 4]
mov dword [0x4cafef], 0x1b1
push eax
push dword [esp + 8]
push 4
push 0x4cafef
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4cae72
call esi
lea eax, [esp + 4]
mov dword [0x4cae72], 0x100e53f0
push eax
push dword [esp + 8]
push 4
push 0x4cae72
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4cae77
call esi
lea eax, [esp + 4]
mov dword [0x4cae77], 0x10007220
push eax
push dword [esp + 8]
push 4
push 0x4cae77
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x44260d
call esi
mov eax, 0x100e5670
sub eax, 0x442611
mov dword [0x44260d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x44260d
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4cb310
call esi
mov byte [0x4cb310], 0xe9
mov eax, 0x100e5640
sub eax, 0x4cb315
mov dword [0x4cb311], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4cb310
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4cb568
call esi
mov eax, 0x100e5650
mov byte [0x4cb568], 0xe9
sub eax, 0x4cb56d
mov dword [0x4cb569], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4cb568
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4cb1fd
call esi
mov eax, 0x100e56d0
mov byte [0x4cb1fd], 0xe8
sub eax, 0x4cb202
mov dword [0x4cb1fe], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4cb1fd
call esi
push 1
push 0x100e5680
mov edx, 0x4f5dd1
mov cl, 0xe8
call fcn.100120f0
push 1
push 0x100e5680
mov edx, 0x4f5df6
mov cl, 0xe8
call fcn.100120f0
pop esi
pop ecx
ret
Function at 0x100e5900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push 1
push 0x100e5050
mov edx, 0x4ec59f
mov byte [0x10182329], 1
mov cl, 0xe8
call fcn.100120f0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x4ec5ac
call esi
lea eax, [esp + 4]
mov byte [0x4ec5ac], 0xe9
push eax
push dword [esp + 8]
push 1
push 0x4ec5ac
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4ec5ad
call esi
lea eax, [esp + 4]
mov dword [0x4ec5ad], 0x246
push eax
push dword [esp + 8]
push 4
push 0x4ec5ad
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4ec33e
call esi
lea eax, [esp + 4]
mov dword [0x4ec33e], 0x100e53f0
push eax
push dword [esp + 8]
push 4
push 0x4ec33e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4ec352
call esi
lea eax, [esp + 4]
mov dword [0x4ec352], 0x10007220
push eax
push dword [esp + 8]
push 4
push 0x4ec352
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43c3de
call esi
mov eax, 0x100e58f0
sub eax, 0x43c3e2
mov dword [0x43c3de], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43c3de
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ec9f8
call esi
mov eax, 0x100e5640
mov byte [0x4ec9f8], 0xe9
sub eax, 0x4ec9fd
mov dword [0x4ec9f9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ec9f8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ecdcb
call esi
mov eax, 0x100e5650
mov byte [0x4ecdcb], 0xe9
sub eax, 0x4ecdd0
mov dword [0x4ecdcc], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ecdcb
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4ec884
call esi
mov eax, 0x100e56d0
mov byte [0x4ec884], 0xe8
sub eax, 0x4ec889
mov dword [0x4ec885], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4ec884
call esi
push 1
push 0x100e5680
mov edx, 0x525781
mov cl, 0xe8
call fcn.100120f0
push 1
push 0x100e5680
mov edx, 0x5257a6
mov cl, 0xe8
call fcn.100120f0
pop esi
pop ecx
ret

Function at 0x100e5ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
movzx eax, byte [eax + 0x100e5e0c]
jmp dword [eax*4 + 0x100e5d94]
Function at 0x100e65f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0x40
push 4
push 0x477ae8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100e6570
sub eax, 0x477aec
mov dword [0x477ae8], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x477ae8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x28
mov ecx, 0x100e6590
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x100e664f
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x100e6590
mov dword [eax + 0x24], eax
lea eax, [esp + 0x2c]
mov ecx, 0x10154e30
push eax
call fcn.1001d210
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x100e6697
push dword [esp]
mov edx, dword [esp + 0xc]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0xc]
mov eax, 0x66666667
mov ecx, dword [esp + 4]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
sub esp, 0x28
mov ecx, 0x10154dd0
mov eax, esp
mov dword [eax], 0x10132734
mov dword [eax + 0x24], eax
lea eax, [esp + 0x2c]
push eax
call fcn.1001d210
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x100e66ed
push dword [esp]
mov edx, dword [esp + 0xc]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0xc]
mov eax, 0x66666667
mov ecx, dword [esp + 4]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
add esp, 0x10
ret

Function at 0x100e6760
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x101553ac]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x101553b8]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x101553a4]
cmp edi, edx
jne 0x100e67c0
mov ecx, edx
jmp 0x100e67c5
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100e67ea
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100e67d4
mov eax, dword [eax]
jmp 0x100e67b8
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8
Function at 0x100e7490
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x10
mov ecx, 0x100e73e0
sub esp, 0x28
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x100e74b8
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x100e73e0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x2c]
mov ecx, 0x10154dd0
push eax
call fcn.1001d210
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x100e7500
push dword [esp]
mov edx, dword [esp + 0xc]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0xc]
mov eax, 0x66666667
mov ecx, dword [esp + 4]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
lea eax, [esp]
push eax
push 0x40
push 5
push 0x4bb22f
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100e7480
mov byte [0x4bb22f], 0xe9
sub eax, 0x4bb234
mov dword [0x4bb230], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x4bb22f
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
ret

Function at 0x100fb9b6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100fb835

Function at 0x10105d92
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10105a52
Function at 0x40b2b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40b2fe
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40b2cd
jmp 0x40b2fe
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40b2ee
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40c394
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c3c9
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c3f3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c3f3
test edi, edi
je 0x40c3c0
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c3c0
test edi, edi
je 0x40c3fb
mov eax, edi
jmp 0x40c3c2
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c3c2
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00410107
add esp, 0xc
int3
Function at 0x41013b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestPair.exe_gMozillaPoisonSize], eax
call fcn.0040c394
pop ecx
mov ecx, dword [sym.TestPair.exe_gMozillaPoisonSize]
mov dword [sym.TestPair.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x410173
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestPair.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x100471fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x100a7620
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.100a6791
mov dword es:[edx + 0x4c], edx
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100a676f
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x465030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x467b68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x467b68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x467b6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x467b70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x467b78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x467b74], eax
mov eax, dword [0x467b74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x467b78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x467b78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x467b6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x467b70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x467b68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret