joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0ff0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 0xc]
call fcn.004b4d10
test al, al
jne 0x4a10c4
mov dword [esp], str._Sensors__Sending_messages_asynchronously
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
mov dword [ebp - 0x14], 0
mov dword [esp], 0x24
call sub.libstdc_6.dll_operator_new_unsigned_int_
mov ebx, eax
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], 0xc9137c
mov dword [eax + 0x10], 0
mov ecx, ebx
mov dword [eax + 0x14], 0
mov dword [eax + 0xc], 0xc91144
mov dword [eax + 0x18], fcn.0049d7f0
mov eax, esi
mov byte [ebx + 0x1c], al
mov eax, dword [ebp + 8]
mov dword [ebx + 0x20], eax
mov dword [esp], sym.imp.libstdc_6.dll_vtable_for___cxxabiv1::__vmi_class_type_info
call fcn.0053f840
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
sub esp, 4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
mov dword [esp], eax
call fcn.004e4c38
mov ebx, dword [ebp - 0xc]
sub esp, 4
test ebx, ebx
je 0x4a109e
lock sub dword [ebx + 4], 1
je 0x4a10e0
lea ecx, [ebp - 0x14]
call fcn.004e4c18
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.libwinpthread_1.dll_pthread_equal
test eax, eax
je 0x4a10f7
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, esi
movzx esi, al
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0049d7f0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
lock sub dword [ebx + 8], 1
jne 0x4a109e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
jmp 0x4a109e
call fcn.004e4a60
mov ecx, dword [ebp - 0xc]
mov ebx, eax
test ecx, ecx
je 0x4a110a
call fcn.0053f010
mov dword [esp], ebx
call sub.libgcc_s_dw2_1.dll__Unwind_Resume
lea ecx, [ebp - 0x14]
mov ebx, eax
call fcn.00543ad0
jmp 0x4a110a
Function at 0x4b4420
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov eax, 0x806c
push esi
push ebx
call fcn.004e4e70
mov ecx, 0xe
sub esp, eax
xor eax, eax
lea ebx, [esp + 0x28]
mov ebp, dword [esp + 0x8080]
mov esi, dword [esp + 0x8084]
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x8088]
mov dword [esp + 0x1c], 0x38
mov dword [esp + 0x18], 0xc85da7
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 8
mov dword [esp + 0xc], 0x1f
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004c29a0
test eax, eax
jne 0x4b4590
mov eax, dword [ebp]
lea edi, [esp + 0x60]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x2c], eax
jmp 0x4b44b4
test ebp, ebp
jne 0x4b4503
mov dword [esp + 4], 4
mov dword [esp], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x8000
call fcn.004c1110
mov ecx, dword [esi + 4]
mov ebp, eax
mov eax, dword [esp + 0x3c]
cmp eax, ecx
jbe 0x4b44b0
mov edx, 0x7fffffff
sub eax, ecx
sub edx, ecx
cmp eax, edx
ja 0x4b45df
mov dword [esp + 4], eax
mov dword [esp], edi
mov ecx, esi
call fcn.004e4bc8
sub esp, 8
test ebp, ebp
je 0x4b44b4
mov dword [esp], ebx
call fcn.004c2870
cmp ebp, 1
mov eax, 1
je 0x4b4585
mov dword [esp + 8], 0x24
mov dword [esp + 4], str.Exception_during_zlib_compression:__
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
mov esi, dword [esp + 0x40]
call fcn.004e4af0
mov ecx, sym.imp.libstdc_6.dll_std::cerr
mov dword [esp], ebp
call fcn.004e4d30
sub esp, 4
mov ebx, eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0xc85dfd
mov dword [esp], eax
call fcn.004e4af0
test esi, esi
je 0x4b45c5
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.004e4af0
mov dword [esp], ebx
call fcn.004e4a70
xor eax, eax
add esp, 0x806c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x26
mov dword [esp + 4], str.deflateInit2_failed_while_compressing.
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call fcn.004e4af0
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call fcn.004e4a70
add esp, 0x806c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
add ecx, ebx
mov eax, dword [ecx + 0x14]
or eax, 1
mov dword [esp], eax
call fcn.004e4b08
sub esp, 4
jmp 0x4b457b
mov dword [esp], 0xc85d2a
call fcn.004e4aa8
nop
lea esi, [esi]
Function at 0x4b7a30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x7c]
lea ebx, [ebp - 0x74]
mov edi, ecx
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], ebx
mov dword [esp + 4], esi
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x74], 0
mov dword [esp], eax
call fcn.004b48d0
test al, al
jne 0x4b7a90
mov edx, dword [ebp - 0x7c]
cmp edx, ebx
je 0x4b7a81
mov dword [esp], edx
mov byte [ebp - 0x89], al
call sub.libstdc_6.dll_operator_delete_void_
movzx eax, byte [ebp - 0x89]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
lea ecx, [ebp - 0x64]
mov dword [esp], 0xc85d3f
call fcn.004b2e90
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], esi
mov dword [esp + 4], edi
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x64]
mov dword [esp + 8], eax
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call fcn.004b7420
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x5c]
cmp eax, edx
je 0x4b7add
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
cmp dword [ebp - 0x4c], 0xc8
je 0x4b7b90
mov dword [esp], str._sensors__SensorsAnalytics_SDK_send_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
mov dword [esp + 8], 0x22
mov dword [esp + 4], str.SensorsAnalytics_SDK_send_failed:
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call fcn.004e4af0
mov eax, dword [ebp - 0x44]
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
call fcn.004e4af0
mov dword [esp], eax
call fcn.004e4a70
xor esi, esi
mov dword [esp], 0xcbffe8
call sub.libwinpthread_1.dll_pthread_mutex_lock
test eax, eax
jne 0x4b7b97
mov eax, esi
mov dword [esp], 0xcbffe8
mov byte [0xcbffe4], al
call sub.libwinpthread_1.dll_pthread_mutex_unlock
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
mov dword [esp], eax
call fcn.00549bf0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
sub esp, 4
cmp eax, edx
je 0x4b7b80
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov eax, esi
jmp 0x4b7a65
mov esi, 1
jmp 0x4b7b3a
mov dword [esp], eax
call fcn.004e4a98
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.00526030
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x4b7bb8
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
mov dword [esp], esi
call sub.libgcc_s_dw2_1.dll__Unwind_Resume
mov esi, eax
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x5c]
cmp eax, edx
je 0x4b7ba9
mov dword [esp], eax
call sub.libstdc_6.dll_operator_delete_void_
jmp 0x4b7ba9
Function at 0x4dfbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x28]
add eax, 1
add eax, dword [esp + 0x2c]
cmp dword [esp + 0x28], 1
mov dword [esp + 0xc], eax
jle 0x4dfca7
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x28]
xor edx, edx
mov dword [esp + 8], 1
neg eax
not ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov ecx, ebp
mov ebp, edx
sub eax, 1
mov dword [esp + 0x10], eax
lea esi, [esi]
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
movzx eax, byte [edi - 1]
add esi, edi
mov dword [esp], esi
mov esi, eax
mov ebx, dword [esp + 4]
movzx eax, byte [edi]
movzx ebx, byte [edi + ebx]
mov edx, eax
or edx, ebx
and ebx, eax
or edx, esi
or dl, byte [edi + ecx]
and ebx, esi
and bl, byte [edi + ecx]
mov esi, eax
xor edx, 1
or edx, ebx
lea ebx, [ebp + 3]
and edx, 1
cmovne ebp, ebx
add edi, 1
cmp dword [esp], edi
jne 0x4dfc53
add dword [esp + 8], 1
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 8]
add dword [esp + 0xc], esi
cmp esi, eax
jne 0x4dfc40
add esp, 0x14
mov edx, ebp
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
add esp, 0x14
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
Function at 0x4e3ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0xcc0a60]
test esi, esi
jle 0x4e3df0
mov edi, dword [0xcc0a64]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4e3d14
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4e3d95
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4e3d00
mov dword [esp], eax
mov ebx, eax
call fcn.004e45d0
test eax, eax
mov edi, eax
je 0x4e3e17
mov eax, dword [0xcc0a64]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004e46d0
add eax, dword [edi + 0xc]
mov edx, dword [0xcc0a64]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4e3df7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4e3d8e
sub eax, 4
and eax, 0xfffffffb
jne 0x4e3da0
add dword [0xcc0a60], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0xcc0a64]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4e3d8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00552f60
lea esi, [esi]
xor esi, esi
jmp 0x4e3d1e
mov eax, dword [0xcc0a64]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00552f60
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00552f60
mov esi, esi
lea edi, [edi]

Function at 0x4e4250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xcc0a78
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xcc0a70]
sub esp, 4
test ebx, ebx
je 0x4e42a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4e429e
test esi, esi
je 0x4e429e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4e4280
mov dword [esp], 0xcc0a78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4e4830
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x4e49bc
mov eax, dword [esp + 0x3c]
add eax, 1
lea edx, [eax*4]
cmp eax, 0x20000000
mov eax, 0xffffffff
cmovb eax, edx
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov edx, dword [esp + 0x3c]
mov edi, eax
test edx, edx
je 0x4e494c
xor ebx, ebx
nop
lea esi, [esi]
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [edi + ebx*4], esi
add ebx, 1
cmp dword [esp + 0x3c], ebx
jne 0x4e48a0
lea eax, [edi + ebx*4]
mov dword [eax], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0040e970
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4e49a8
mov eax, dword [edi]
test eax, eax
je 0x4e49a8
xor ebx, ebx
jmp 0x4e4997
mov eax, dword [edi + ebx*4]
test eax, eax
je 0x4e49a8
mov dword [esp], eax
add ebx, 1
call sub.libstdc_6.dll_operator_delete___void_
cmp dword [esp + 0x3c], ebx
jne 0x4e4990
mov dword [esp], edi
call sub.libstdc_6.dll_operator_delete___void_
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov esi, 0xffffffff
jmp 0x4e49b0
Function at 0x4e6080
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [ecx - 1]
mov ecx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
sar eax, 0x1f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ebx
sar ebx, 0x1f
imul ecx
mov ecx, edx
sar ecx, 2
sub ecx, ebx
mov ebx, 1
je 0x4e60d3
mov ebp, 0x66666667
mov eax, ecx
sar ecx, 0x1f
add ebx, 1
imul ebp
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x4e60c0
mov edx, dword [esi + 0x28]
cmp edx, 0xffffffff
je 0x4e6150
mov ecx, dword [esi + 8]
cmp ebx, edx
cmovl ebx, edx
lea edx, [ebx + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, 1
mov edx, edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
add ebx, 1
mov dword [esp], esi
call fcn.004e5930
mov eax, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [esi + 4], edx
mov edx, esi
call fcn.004e5500
add dword [esi + 8], ebx
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004e5d70
mov eax, dword [0x5692fc]
cmp eax, 0xffffffff
je 0x4e6185
test eax, eax
je 0x4e6175
mov edx, 2
mov dword [esi + 0x28], edx
jmp 0x4e60db
mov dword [0x5692fc], 0
call fcn.004ea460
test al, 1
mov edx, 3
jne 0x4e615e
jmp 0x4e6163
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4e616b
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
ja 0x4e616b
mov dword [0x5692fc], 1
jmp 0x4e615e
Function at 0x552f60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004ea370
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004ea370
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
pop ebp
jmp fcn.004014e0
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x37e63773
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x3f667647
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x77fe199a
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x61cd449d
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40bfb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40c003
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40bfd2
jmp 0x40c003
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40bff3
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40cf26
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40cf5b
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40cf85
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40cf85
test edi, edi
je 0x40cf52
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40cf52
test edi, edi
je 0x40cf8d
mov eax, edi
jmp 0x40cf54
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40cf54
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00410acb
add esp, 0xc
int3
Function at 0x410aff
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestSaturate.exe_gMozillaPoisonSize], eax
call fcn.0040cf26
pop ecx
mov ecx, dword [sym.TestSaturate.exe_gMozillaPoisonSize]
mov dword [sym.TestSaturate.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x410b37
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestSaturate.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x40452b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040348c
and dword [ebp - 0x14], 0
cmp dword [0x40b924], 0
mov dword [ebp - 0x18], eax
jne 0x4045de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404686
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404686
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b924], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b928], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b92c], eax
call edi
push eax
call esi
mov dword [0x40b934], eax
test eax, eax
je 0x4045de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b930], eax
mov eax, dword [0x40b930]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x404637
cmp dword [0x40b934], ecx
je 0x404637
push eax
call esi
push dword [0x40b934]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404637
test ebx, ebx
je 0x404637
call edi
test eax, eax
je 0x40462e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40462e
test byte [ebp - 8], 1
jne 0x404637
or dword [ebp + 0x10], 0x200000
jmp 0x40466a
mov eax, dword [0x40b928]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40466a
mov eax, dword [0x40b92c]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b924]
call esi
test eax, eax
je 0x404686
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404688
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404896
leave
ret

Function at 0x404896
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a700]
jne 0x4048a0
repz ret
jmp fcn.00405a36