joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e350
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x496873
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00488282
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0048d9f4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0048ef4c
test eax, eax
je 0x45e46c
mov ecx, dword [esp + 0x3c]
call fcn.0048da21
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45e430
push edi
mov ecx, esi
call fcn.0048afdf
mov ecx, esi
call fcn.0045e5d0
cmp dword [esp + 0x38], 1
jne 0x45e465
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0048b149
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x460e90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x460ec3
push esi
call fcn.00463f80
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x460ebc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x460f49
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x460f32
mov eax, dword [esi + 8]
test eax, eax
je 0x460ee7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x460f2e
cmp eax, 2
je 0x460f32
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x460eda
cmp eax, 3
je 0x460f0d
cmp eax, 1
jne 0x460eda
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x460eda
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x460eda
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00460f70
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x460f58
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00460f70
add esp, 4
pop esi
ret

Function at 0x489077
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4890af
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00487104
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004870dc
jmp 0x4890bb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48a768
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48a7aa
call fcn.00490453
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48a7aa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48a7a1
xor eax, eax
jmp 0x48a7b2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048a7b8
pop edi
pop esi
pop ebx
ret 4

Function at 0x490983
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4909b1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4909cf
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004908e9
jmp 0x4909cf
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4909cf
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004908e9
test edi, edi
mov eax, edi
jne 0x4909b9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40c1d0
Capabilities:
Encode data using xor

Disassembly:
les edi, [eax + 0x458b5653]
or byte [ebx + 0x318b8], al
add byte [eax], al
jle 0x40c2e9
cmp dword [ebp + 0x10], 0x2800
jle 0x40c2e9
mov edx, 4
mov eax, dword [ebp + 0xc]
call fcn.00458168
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x30]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp + 0x10]
sar edx, 1
jns 0x40c218
adc edx, 0
mov eax, dword [ebp + 0xc]
call fcn.00458168
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x48]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x318], 1
jne 0x40c28a
push 0x15
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0046966c
mov ecx, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x18]
push ebp
call 0x35d43e1
add byte [eax], al
mov eax, dword [ebp + 8]
cmp dword [eax + 0x318], 2
jne 0x40c2bd
xor eax, eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
mov ebx, 0x14
mov esi, dword [ebp + 8]
sub ebx, eax
inc eax
mov bl, byte [esi + ebx + 0x320]
xor bl, byte [edx]
xor bl, byte [ecx]
inc ecx
mov byte [edx], bl
inc edx
cmp eax, 0x14
jl 0x40c29e

Function at 0x40c250
Capabilities:
Encode data using xor

Disassembly:
push ebp
call 0x35d43e1
add byte [eax], al
push eax
push 0x484b50
push edx
call fcn.0046c1e4
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
mov ebx, 0x14
sub ebx, eax
inc eax
mov bl, byte [ebp + ebx - 0x18]
xor bl, byte [edx]
xor bl, byte [ecx]
inc ecx
mov byte [edx], bl
inc edx
cmp eax, 0x14
jl 0x40c26f
jmp 0x40c2bd
mov edx, dword [ebp + 0x10]
sar edx, 1
jns 0x40c2c7
adc edx, 0
mov eax, dword [ebp + 0xc]
call fcn.00458168
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x48]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 8]
xor edx, edx
mov eax, dword [ebp + 0xc]
call fcn.00458168
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40efa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x318], 0
jle 0x40f0c5
cmp dword [ebp + 0x10], 0x2800
jle 0x40f0c5
mov edx, 4
mov eax, dword [ebp + 0xc]
call fcn.0045af44
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x30]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp + 0x10]
sar edx, 1
jns 0x40eff4
adc edx, 0
mov eax, dword [ebp + 0xc]
call fcn.0045af44
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x48]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x318], 1
jne 0x40f066
push 0x15
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0046c448
mov ecx, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x18]
mov eax, dword [ecx + 0x31c]
push eax
push 0x484b50
push edx
call fcn.0046efc0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
mov ebx, 0x14
sub ebx, eax
inc eax
mov bl, byte [ebp + ebx - 0x18]
xor bl, byte [edx]
xor bl, byte [ecx]
inc ecx
mov byte [edx], bl
inc edx
cmp eax, 0x14
jl 0x40f04b
jmp 0x40f099
mov eax, dword [ebp + 8]
cmp dword [eax + 0x318], 2
jne 0x40f099
xor eax, eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
mov ebx, 0x14
mov esi, dword [ebp + 8]
sub ebx, eax
inc eax
mov bl, byte [esi + ebx + 0x320]
xor bl, byte [edx]
xor bl, byte [ecx]
inc ecx
mov byte [edx], bl
inc edx
cmp eax, 0x14
jl 0x40f07a
mov edx, dword [ebp + 0x10]
sar edx, 1
jns 0x40f0a3
adc edx, 0
mov eax, dword [ebp + 0xc]
call fcn.0045af44
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x48]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 8]
xor edx, edx
mov eax, dword [ebp + 0xc]
call fcn.0045af44
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4131fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov edx, dword [ebp + 0xc]
mov ecx, eax
inc eax
shl ecx, 2
push ecx
mov cl, 0x64
pop ebx
sub cl, bl
xor byte [edx], cl
inc edx
cmp eax, 0x28
jl 0x413205
pop ebx
pop ebp
ret

Function at 0x4184f8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7bc
mov eax, 0x48612c
push ebx
push esi
push edi
call fcn.00471da8
mov edx, dword [ebp + 8]
cmp byte [edx + 0x1494], 1
jne 0x4187de
mov word [ebp - 0x24], 8
lea eax, [ebp - 4]
call fcn.004117dc
inc dword [ebp - 0x18]
xor ecx, ecx
mov word [ebp - 0x24], 0x14
lea edx, [ebp - 0x83c]
lea eax, [ebp - 0x43c]
mov byte [eax], 0
mov byte [edx], 0
inc ecx
inc edx
inc eax
cmp ecx, 0xa
jl 0x418543
mov eax, dword [ebp + 8]
add eax, 0x1484
call fcn.00414dc4
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea edx, [ebp - 0x43c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x43c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00471b34
pop ecx
mov edi, eax
mov dword [ebp - 0x38], 0xffffff9c
xor ecx, ecx
lea eax, [ebp - 0x43c]
cmp edi, ecx
jle 0x4185b8
mov dl, byte [eax]
inc eax
and edx, 0xff
inc ecx
add dword [ebp - 0x38], edx
cmp edi, ecx
jg 0x4185a7
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov dword [ebp - 0x844], eax
mov dword [ebp - 0x840], ecx
fild qword [ebp - 0x844]
fld xword [0x40ac18]
fmulp st(1)
fadd dword [0x40ac24]
call fcn.00475f2c
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x844], edx
mov dword [ebp - 0x840], ecx
fild qword [ebp - 0x844]
fmul qword [0x40ac28]
call fcn.00475f2c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
add eax, 0x1488
call fcn.00414dc4
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea edx, [ebp - 0x43c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x43c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00471b34
pop ecx
mov edi, eax
xor ecx, ecx
lea esi, [ebp - 0x43c]
cmp edi, ecx
jle 0x418688
mov eax, ecx
mov ebx, 3
cdq
idiv ebx
mov dl, byte [esi]
add dl, 0xec
mov ebx, ecx
and ebx, 0x80000001
jns 0x418677
dec ebx
or ebx, 0xfffffffe
inc ebx
add ebx, ebx
inc ecx
lea ebx, [ebx + ebx*4]
sub dl, bl
add al, dl
mov byte [esi], al
inc esi
cmp edi, ecx
jg 0x418659
lea eax, [ebp - 0x43c]
lea esi, [ebp - 0x83c]
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x83c]
idiv edi
inc dword [ebx + 0x458d03e1]
clc

Function at 0x418808
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov edx, dword [ebp + 0xc]
mov ecx, eax
inc eax
shl ecx, 2
push ecx
mov cl, 0x64
pop ebx
sub cl, bl
xor byte [edx], cl
inc edx
cmp eax, 0x28
jl 0x418811
pop ebx
pop ebp
ret
Function at 0x423750
Capabilities:
Encode data using xor

Disassembly:
push 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0xc], al
adc eax, dword [eax]
or al, byte [edx + esi*2 + 0x61]
inc ebx
jne 0x4237dc
jae 0x4237db
jb 0x423762
imul eax, dword [ebx], 0xff00008b
mov eax, dword [eax]
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc al, 0
or byte [edx + esi*2 + 0x61], al
dec ebx
imul ebp, dword [esi + 0x64], 0x4369c0
dec ebp
add byte [eax], al
call [eax]
add dh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc eax, 0x72440800
popal
dec ebp
outsd dx, dword [esi]
call 0x4c427da9
add byte [eax], al
invalid
add bh, bh
push dword [eax]
mov bl, 0x43
add byte [eax - 0x4d], al
xor byte [ebx - 0x4cbfffbd], dh
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x46040017], al
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x4237dd
int1
inc ebp
add cl, bh
add dword [eax], eax
call eax
outsb dx, byte [esi]
inc ecx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
sbb byte [eax], al
or eax, 0x65646948
push ebx
insb byte es:[edi], dx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
mov byte [ebp + 0x43], dh
add byte [ecx + eax], dl
call dword [ecx + eax]
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], 0
add byte [eax], al
sbb dword [eax], eax
pop es
dec ecx
insd dword es:[edi], dx
dec ebp
outsd dx, dword [esi]
adc byte gs:[esi + 0x43], dh
add byte [eax + 1], bl
add bh, bh
pop eax
add dword [eax], eax
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4907001a], al
insd dword es:[edi], dx
dec esi
popal
insd dword es:[edi], dx
and al, 0xf2
inc ebp
add al, dh
add dword [eax], eax
jmp esp
Function at 0x42cb14
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42cb1a
ret

Function at 0x43c088
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax + 0x10], ah
inc esi
add al, cl
or eax, 0xddc0046
inc esi
add ah, dl
inc ecx
add byte [ecx], al
add bh, bh
dec dword [eax]
das
inc ecx
add byte [ebx], cl
push esp
inc ebx
push 0x65676e61
dec esp
imul ebp, dword [esi + 0x6b], 0x411684
add ecx, dword [0x61724454]
ja 0x43c0e5
outsb dx, byte [esi]
push ebx
je 0x43c0fa
insb byte es:[edi], dx
add dword gs:[eax], eax
add byte [eax], al
add byte [ebx], al
add eax, dword [eax]
add byte [eax], al
adc byte [esi], 0x41
add byte [edi], al
add eax, dword [eax]
add byte [eax], al
adc byte [esi], 0x41
add byte [edi], al
jae 0x43c0da
outsd dx, dword [esi]
arpl word [ebp + 0x73], si
or ah, byte [ebx + esi*2 + 0x53]
insb byte es:[edi], dx
arpl word gs:[ebp + 0x64], si
or byte [ebx + esi*2 + 0x4e], ah
outsd dx, dword [esi]
jb 0x43c117
popal
insb byte es:[edi], dx
or eax, 0x72547364
popal
outsb dx, byte [esi]
jae 0x43c125
popal
jb 0x43c11d
outsb dx, byte [esi]
je 0x43c04b
nop
rcl byte [esi]
inc ecx
add byte [ebx], al
or dl, byte [ecx + ecx*2 + 0x6d]
popal
push esp
jns 0x43c13b
add dword gs:[eax], eax
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add ah, cl
push ss
inc ecx
add byte [edi], al
imul esi, dword [ecx + ecx*2 + 0x6d], 0x6656761
imul esi, dword [ebp + ecx*2 + 0x61], 0x16fc6b73
popal
jae 0x43c153
cld
push ss
inc ecx
add byte [ecx], al
or edx, dword [ecx + ecx*2 + 0x6d]
popal
dec ecx
outsb dx, byte [esi]
js 0x43c0fe
add byte [eax], al
add byte [eax + 0x7fffffff], al
nop
nop
pushal
pop ss
inc ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + edx + 0x41], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + edx + 0x17a40041], bl
pushfd
pop ss
inc ecx
invalid
movsb byte es:[edi], byte [esi]
pop ss
pop ss
inc ecx
add byte [eax], ah
add byte [eax + 0x2a], al
inc ecx
add al, bh
Function at 0x4699c0
Capabilities:
Packed with generic packer

Disassembly:
fimul dword [ecx - 0x3fcc03bb]
push ebp
push 0x451c5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004697a0
xor eax, eax
push ebp
push 0x451c3a
push dword fs:[eax]
mov dword fs:[eax], esp
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0x75411100
je 0x469a6a
dec esp
imul ebp, dword [esi + 0x65], 0x75646552
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
call 0x5146dffe
add byte [eax], al
call dword [ecx]
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
push es
add byte [ecx], cl
inc ecx
jne 0x469a9a
outsd dx, dword [esi]
push eax
outsd dx, dword [esi]
jo 0x469aa0
jo 0x469a99
out dx, eax
inc esp
add byte [eax + eax], ah
add bh, bh
mov eax, ss
inc ecx
add byte [ecx + ecx*8 + 0x41], al
add byte [eax - 0x80000000], al
pop es
add byte [eax], cl
inc edx
imul eax, dword [ecx + ebp*2 + 0x4d], 0xd465646f
out dx, eax
inc esp
add byte [eax + ebx*8 - 0x276bffbf], cl
inc ecx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], al
or byte [eax], al
add byte [ebx], cl
dec eax
insb byte es:[edi], dx
dec eax
insb byte es:[edi], dx
jo 0x469ab2
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x469ad8
js 0x469ae9
mov eax, 0x3c004117
add byte [eax], al
add byte [ecx], bl
add bh, bh
pop ecx
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], al
pop ecx
add byte [eax], al
call [ecx]
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, byte [eax]
or eax, 0x756e654d
jne 0x469af7
outsb dx, byte gs:[esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], al
or eax, dword [eax]
or dword [edi + 0x77], ecx
outsb dx, byte [esi]
jb 0x469b23
jb 0x469b42
ja 0x469acb
int1
inc ebp
add byte [0xa0ff0000], dh
rol byte [ecx], 1
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
or al, 0
jmp dword [eax + 0x10041d0]
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f08000e], al
Function at 0x47c8ac
Capabilities:
Packed with generic packer

Disassembly:
adc byte fs:[esi], al
push 0x6c004610
adc byte [esi], al
pushal
adc byte [esi], al
enter 0x460d, 0
fmul qword [0xe240046]
inc esi
add byte [edi], al
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [esp + edi*4 - 0xe], si
inc ebp
add byte [edi], al
pop es
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + esi*4 - 0xe], si
inc ebp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], al
push ebx
jns 0x47c95e
je 0x47c952
insd dword es:[edi], dx
add byte [eax], al
fdivr st(2), st(0)
inc ebp
add byte [edi], cl
or byte [ecx + 0x55], cl
outsb dx, byte [esi]
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, al
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc esi
push es
push ebx
jns 0x47c98a
je 0x47c97e
insd dword es:[edi], dx
add byte [eax], al
int3
add byte [eax], al
add byte [eax], al
rol byte [eax], 0
add byte [eax], al
add byte [eax], al
inc esi
inc ebp
add byte [eax], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x45f3a090], dl
add byte [edx], dh
inc ebp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0xc0045f3], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, byte [0xc0045f3]
add byte [eax], al
add byte [edx + esi*8 + 0x45], ah
add byte [eax + 0x10], bl
inc esi
add ah, dl
xor dword [esi], eax
loopne 0x47c9d3
inc esi
add byte [eax + edx + 0x46], ch
add byte [eax + 0x10], ah
inc esi
add al, dh
xor dword [esi], eax
fmul qword [0xe240046]
inc esi
add byte [ecx], dl
push esp
dec ecx
outsb dx, byte [esi]
je 0x47ca23
jb 0x47ca26
popal
arpl word [ebp + 0x64], sp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + edx*4 - 0x70], si
add byte [eax], al
Function at 0x40b1a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46664b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045b328
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b222
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00459277
mov eax, dword [eax]
push 0x4801d0
push eax
call fcn.0044c174
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045b5b3
test bl, bl
je 0x40b222
push 0x4801d0
lea ecx, [esp + 0xc]
call fcn.0045b943
push 0x483d20
lea ecx, [esp + 0xc]
call fcn.0045b943
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b25e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045b5b3
jmp 0x40b329
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b2e2
lea edx, [esp + 0x7c]
push 0x483d1c
push edx
call fcn.0044c174
add esp, 8
test eax, eax
je 0x40b2e2
lea eax, [esp + 0x7c]
push 0x483d18
push eax
call fcn.0044c174
add esp, 8
test eax, eax
je 0x40b2e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b272
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045b5b3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40bb20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40bb82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc