joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4544d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3d
xor al, 0x37
inc edi
inc esi
inc ebx
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4a4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x3dc], edx
push ecx
or ecx, 0xd339
call 0x454501
add byte [eax], bh
inc esp
dec ebx
inc ebx
aaa
inc esp
dec esp
dec esi
dec ecx
add esp, 4
sub ecx, 0x14153
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0x3cbb
sub eax, 0x12123
pop eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jne 0x454570
push eax
push edi
add esp, 4
call 0x454547
add byte [edi], bh
inc ecx
inc ecx
inc eax
inc ecx
inc esi
cmp byte [ebx + 0x47], cl
add esp, 4
pop eax
push ebx
jmp 0x454551
sub ebx, 0x252d
and ebx, 0x8998
add ebx, 0x70e3
pop ebx
mov dword [ebp - 0x6c], 0
jmp 0x4548fc
push eax
push ecx
add esp, 4
xor eax, 0x6453
add eax, 0x9ae0
xor eax, 0x158ba
xor eax, 0x520a
pop eax
push edx
call 0x45459e
add byte [edi + 0x37], al
xor al, 0x4d
cmp dword [eax], edi
cmp dh, byte [edi]
add esp, 4
pop edx
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
invalid
invalid

Function at 0x4544d8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3d
xor al, 0x37
inc edi
inc esi
inc ebx
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4a4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x3dc], edx
push ecx
or ecx, 0xd339
call 0x454501
add byte [eax], bh
inc esp
dec ebx
inc ebx
aaa
inc esp
dec esp
dec esi
dec ecx
add esp, 4
sub ecx, 0x14153
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0x3cbb
sub eax, 0x12123
pop eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jne 0x454570
push eax
push edi
add esp, 4
call 0x454547
add byte [edi], bh
inc ecx
inc ecx
inc eax
inc ecx
inc esi
cmp byte [ebx + 0x47], cl
add esp, 4
pop eax
push ebx
jmp 0x454551
sub ebx, 0x252d
and ebx, 0x8998
add ebx, 0x70e3
pop ebx
mov dword [ebp - 0x6c], 0
jmp 0x4548fc
push eax
push ecx
add esp, 4
xor eax, 0x6453
add eax, 0x9ae0
xor eax, 0x158ba
xor eax, 0x520a
pop eax
push edx
call 0x45459e
add byte [edi + 0x37], al
xor al, 0x4d
cmp dword [eax], edi
cmp dh, byte [edi]
add esp, 4
pop edx
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
invalid
invalid
Function at 0x454501
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3d
xor al, 0x37
inc edi
inc esi
inc ebx
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4a4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x3dc], edx
push ecx
or ecx, 0xd339
call 0x454501
add byte [eax], bh
inc esp
dec ebx
inc ebx
aaa
inc esp
dec esp
dec esi
dec ecx
add esp, 4
sub ecx, 0x14153
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0x3cbb
sub eax, 0x12123
pop eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jne 0x454570
push eax
push edi
add esp, 4
call 0x454547
add byte [edi], bh
inc ecx
inc ecx
inc eax
inc ecx
inc esi
cmp byte [ebx + 0x47], cl
add esp, 4
pop eax
push ebx
jmp 0x454551
sub ebx, 0x252d
and ebx, 0x8998
add ebx, 0x70e3
pop ebx
mov dword [ebp - 0x6c], 0
jmp 0x4548fc
push eax
push ecx
add esp, 4
xor eax, 0x6453
add eax, 0x9ae0
xor eax, 0x158ba
xor eax, 0x520a
pop eax
push edx
call 0x45459e
add byte [edi + 0x37], al
xor al, 0x4d
cmp dword [eax], edi
cmp dh, byte [edi]
add esp, 4
pop edx
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
invalid
invalid

Function at 0x454547
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3d
xor al, 0x37
inc edi
inc esi
inc ebx
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4a4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x3dc], edx
push ecx
or ecx, 0xd339
call 0x454501
add byte [eax], bh
inc esp
dec ebx
inc ebx
aaa
inc esp
dec esp
dec esi
dec ecx
add esp, 4
sub ecx, 0x14153
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0x3cbb
sub eax, 0x12123
pop eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jne 0x454570
push eax
push edi
add esp, 4
call 0x454547
add byte [edi], bh
inc ecx
inc ecx
inc eax
inc ecx
inc esi
cmp byte [ebx + 0x47], cl
add esp, 4
pop eax
push ebx
jmp 0x454551
sub ebx, 0x252d
and ebx, 0x8998
add ebx, 0x70e3
pop ebx
mov dword [ebp - 0x6c], 0
jmp 0x4548fc
push eax
push ecx
add esp, 4
xor eax, 0x6453
add eax, 0x9ae0
xor eax, 0x158ba
xor eax, 0x520a
pop eax
push edx
call 0x45459e
add byte [edi + 0x37], al
xor al, 0x4d
cmp dword [eax], edi
cmp dh, byte [edi]
add esp, 4
pop edx
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
invalid
invalid
Function at 0x45459e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3d
xor al, 0x37
inc edi
inc esi
inc ebx
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4a4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x3dc], edx
push ecx
or ecx, 0xd339
call 0x454501
add byte [eax], bh
inc esp
dec ebx
inc ebx
aaa
inc esp
dec esp
dec esi
dec ecx
add esp, 4
sub ecx, 0x14153
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0x3cbb
sub eax, 0x12123
pop eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jne 0x454570
push eax
push edi
add esp, 4
call 0x454547
add byte [edi], bh
inc ecx
inc ecx
inc eax
inc ecx
inc esi
cmp byte [ebx + 0x47], cl
add esp, 4
pop eax
push ebx
jmp 0x454551
sub ebx, 0x252d
and ebx, 0x8998
add ebx, 0x70e3
pop ebx
mov dword [ebp - 0x6c], 0
jmp 0x4548fc
push eax
push ecx
add esp, 4
xor eax, 0x6453
add eax, 0x9ae0
xor eax, 0x158ba
xor eax, 0x520a
pop eax
push edx
call 0x45459e
add byte [edi + 0x37], al
xor al, 0x4d
cmp dword [eax], edi
cmp dh, byte [edi]
add esp, 4
pop edx
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
invalid
invalid

Function at 0x4545e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [ecx + eax*4]
jmp 0x461b2b
add byte [eax], al
Function at 0x455804
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x120d
pop ebx
push ecx
and ecx, 0x72f2
pop ecx
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x2e8], ecx
jmp 0x4559bf
cmp dword [ebp - 0x2e8], 0
je 0x455a3a
push edi
push esi
add esp, 4
jmp 0x4559d4
pop edi
push eax
push ebx
add esp, 4
sub eax, 0x126de
call 0x4559f0
add byte [ebp + edi + 0x3d], cl
xor al, 0x43
xor al, 0x40
inc ecx
inc ebp
add esp, 4
xor eax, 0x1723
pop eax
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
push edi
sub edi, 0x17ce
add edi, 0x12747
sub edi, 0x16a9d
pop edi
push edi
push edx
add esp, 4
sub edi, 0x539c
sub edi, 0x13daa
sub edi, 0x3e66
jmp 0x455a34
pop edi
jmp 0x455705
push edi
call 0x455a48
add byte [edi + 0x44], cl
push eax
dec edx
aas
dec edx
add esp, 4
jmp 0x455a52
jmp 0x455a58
call 0x455a68
add byte [edx], dh
dec edi
inc ecx
inc esp
xor al, 0x36
dec esp
aas
dec esp
xor eax, 0x5f04c483
mov ecx, dword [ebp - 0x34]
add ecx, 4
mov dword [ebp - 0x328], ecx
jmp 0x455a7f

Function at 0x45595d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x224], 0
jle 0x455981
push edi
push ebx
add esp, 4
and edi, 0xfbed
xor edi, 0x60c2
xor edi, 0xd142
pop edi
push edx
add edx, 0x9cd7
and edx, 0xbcda
and edx, 0xd9d0
xor edx, 0x4e7d
pop edx
mov edx, dword [ebp - 0x1a0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4558eb
push eax
or eax, 0x161a2
sub eax, 0x7487
jmp 0x455892
jmp 0x455899
pop eax
push esi
sub esi, 0xe4e0
pop esi
push ebx
push ebx
add esp, 4
and ebx, 0xf5c1
pop ebx
mov eax, dword [ebp - 0x1a0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x4558d0
mov dword [ebp - 0x2e4], 1
jmp 0x4558da
mov dword [ebp - 0x2e4], 0xffffffff
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x228], ecx
jmp 0x455981
push ebx
push edx
add esp, 4
add ebx, 0x82f4
xor ebx, 0xe234
xor ebx, 0x17a26
and ebx, 0x10383
pop ebx
push edx
add edx, 0xa9bf
and edx, 0xb553
jmp 0x45591c
pop edx
mov edx, dword [ebp - 0x224]
sub edx, 1
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x1a0]
add eax, 1
mov dword [ebp - 0x1a0], eax
push eax
jmp 0x455943
or eax, 0x11507
or eax, 0x8ad7
pop eax
push ecx
call fcn.0045595d
add byte [ecx], bh
inc ebp
dec esp
aas
cmp byte [ecx - 0x7d], cl
add esp, 4
pop ecx
add esp, 4
pop ecx
push edx
push ecx
add esp, 4
add edx, 0xefff
pop edx
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
jmp 0x455827
push edi
push edi
add esp, 4
or edi, 0x9751
and edi, 0x13c01
sub edi, 0x89f3
jmp 0x45599e
pop edi
push edi
add edi, 0x11ca0
xor edi, 0x9e8a
sub edi, 0x32ac
pop edi
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x2e8], edx
Function at 0x455a48
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x120d
pop ebx
push ecx
and ecx, 0x72f2
pop ecx
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x2e8], ecx
jmp 0x4559bf
cmp dword [ebp - 0x2e8], 0
je 0x455a3a
push edi
push esi
add esp, 4
jmp 0x4559d4
pop edi
push eax
push ebx
add esp, 4
sub eax, 0x126de
call 0x4559f0
add byte [ebp + edi + 0x3d], cl
xor al, 0x43
xor al, 0x40
inc ecx
inc ebp
add esp, 4
xor eax, 0x1723
pop eax
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
push edi
sub edi, 0x17ce
add edi, 0x12747
sub edi, 0x16a9d
pop edi
push edi
push edx
add esp, 4
sub edi, 0x539c
sub edi, 0x13daa
sub edi, 0x3e66
jmp 0x455a34
pop edi
jmp 0x455705
push edi
call 0x455a48
add byte [edi + 0x44], cl
push eax
dec edx
aas
dec edx
add esp, 4
jmp 0x455a52
jmp 0x455a58
call 0x455a68
add byte [edx], dh
dec edi
inc ecx
inc esp
xor al, 0x36
dec esp
aas
dec esp
xor eax, 0x5f04c483
mov ecx, dword [ebp - 0x34]
add ecx, 4
mov dword [ebp - 0x328], ecx
jmp 0x455a7f

Function at 0x455a68
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x120d
pop ebx
push ecx
and ecx, 0x72f2
pop ecx
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x2e8], ecx
jmp 0x4559bf
cmp dword [ebp - 0x2e8], 0
je 0x455a3a
push edi
push esi
add esp, 4
jmp 0x4559d4
pop edi
push eax
push ebx
add esp, 4
sub eax, 0x126de
call 0x4559f0
add byte [ebp + edi + 0x3d], cl
xor al, 0x43
xor al, 0x40
inc ecx
inc ebp
add esp, 4
xor eax, 0x1723
pop eax
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
push edi
sub edi, 0x17ce
add edi, 0x12747
sub edi, 0x16a9d
pop edi
push edi
push edx
add esp, 4
sub edi, 0x539c
sub edi, 0x13daa
sub edi, 0x3e66
jmp 0x455a34
pop edi
jmp 0x455705
push edi
call 0x455a48
add byte [edi + 0x44], cl
push eax
dec edx
aas
dec edx
add esp, 4
jmp 0x455a52
jmp 0x455a58
call 0x455a68
add byte [edx], dh
dec edi
inc ecx
inc esp
xor al, 0x36
dec esp
aas
dec esp
xor eax, 0x5f04c483
mov ecx, dword [ebp - 0x34]
add ecx, 4
mov dword [ebp - 0x328], ecx
jmp 0x455a7f
Function at 0x457f1e
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ecx
push eax
and eax, 0xcd05
sub eax, 0x15687
call 0x457f3b
add byte [ebx + 0x32], al
inc edi
dec esp
inc edx
add esp, 4
pop eax
mov byte [ebp - 0x174], 0x4c
mov byte [ebp - 0x173], 0x6f
mov byte [ebp - 0x172], 0x61
mov byte [ebp - 0x171], 0x64
mov byte [ebp - 0x170], 0x4c
mov byte [ebp - 0x16f], 0x69
mov byte [ebp - 0x16e], 0x62
mov byte [ebp - 0x16d], 0x72
mov byte [ebp - 0x16c], 0x61
mov byte [ebp - 0x16b], 0x72
mov byte [ebp - 0x16a], 0x79
mov byte [ebp - 0x169], 0x57
mov byte [ebp - 0x168], 0
push esi
sub esi, 0xcf42
sub esi, 0x14d68
and esi, 0xc5f4
pop esi
push ebx
and ebx, 0xd4d2
and ebx, 0xc8cd
xor ebx, 0x166d1
pop ebx
push edi
jmp 0x457fcb
pop edi
push esi
push edi
add esp, 4
xor esi, 0x5b52
or esi, 0xc293
add esi, 0x17b1e
add esi, 0x16e73
pop esi
push edx
xor edx, 0xff3
add edx, 0x18387
and edx, 0x4b4c
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x444], ecx
push ebx
call 0x45801c
add byte [edi + 0x45], cl
inc edi
inc eax
dec ebp
xor esi, dword [edi]
inc edi
xor al, byte [edx - 0x7d]
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edx], dh
cmp al, 0x36
aaa
xor eax, 0x834e3544
les eax, [ecx + eax*4]
retf

Function at 0x457f3b
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
pop ecx
push eax
and eax, 0xcd05
sub eax, 0x15687
call 0x457f3b
add byte [ebx + 0x32], al
inc edi
dec esp
inc edx
add esp, 4
pop eax
mov byte [ebp - 0x174], 0x4c
mov byte [ebp - 0x173], 0x6f
mov byte [ebp - 0x172], 0x61
mov byte [ebp - 0x171], 0x64
mov byte [ebp - 0x170], 0x4c
mov byte [ebp - 0x16f], 0x69
mov byte [ebp - 0x16e], 0x62
mov byte [ebp - 0x16d], 0x72
mov byte [ebp - 0x16c], 0x61
mov byte [ebp - 0x16b], 0x72
mov byte [ebp - 0x16a], 0x79
mov byte [ebp - 0x169], 0x57
mov byte [ebp - 0x168], 0
push esi
sub esi, 0xcf42
sub esi, 0x14d68
and esi, 0xc5f4
pop esi
push ebx
and ebx, 0xd4d2
and ebx, 0xc8cd
xor ebx, 0x166d1
pop ebx
push edi
jmp 0x457fcb
pop edi
push esi
push edi
add esp, 4
xor esi, 0x5b52
or esi, 0xc293
add esi, 0x17b1e
add esi, 0x16e73
pop esi
push edx
xor edx, 0xff3
add edx, 0x18387
and edx, 0x4b4c
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x444], ecx
push ebx
call 0x45801c
add byte [edi + 0x45], cl
inc edi
inc eax
dec ebp
xor esi, dword [edi]
inc edi
xor al, byte [edx - 0x7d]
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edx], dh
cmp al, 0x36
aaa
xor eax, 0x834e3544
les eax, [ecx + eax*4]
retf
Function at 0x45a7c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45a7db
xor eax, eax
jmp 0x45a814
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x45a7f3
xor eax, eax
jmp 0x45a814
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0x4550
je 0x45a80e
xor eax, eax
jmp 0x45a814
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x45b050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45b06b
xor eax, eax
jmp 0x45b0a4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x45b083
xor eax, eax
jmp 0x45b0a4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0x4550
je 0x45b09e
xor eax, eax
jmp 0x45b0a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x45d030
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4e4150]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x4e94f8], 0
je 0x45d06d
push 0x4e93d0
mov eax, dword [0x4e9500]
push eax
mov ecx, dword [0x4e94fc]
push ecx
mov edx, dword [0x4e94f8]
push edx
call fcn.0045d1f0
add esp, 0x10
mov dword [ebp - 0x11c], 0x4e93d0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x11c]
mov al, byte [edx]
mov byte [ebp - 0x125], al
mov ecx, dword [ebp - 0x120]
mov dl, byte [ebp - 0x125]
mov byte [ecx], dl
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
cmp byte [ebp - 0x125], 0
jne 0x45d08f
lea edx, [ebp - 0x110]
push edx
call fcn.0045cfa0
add esp, 4
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x118]
push eax
call fcn.004822fd
add esp, 4
lea ecx, [ebp - 0x118]
push ecx
call fcn.004803f5
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
add edx, 1
push edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
cdq
mov ecx, 0x64
idiv ecx
push edx
push str.Exception_02d_02d_02d._02d_02d_02d.dbg.txt
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push 1
lea eax, [ebp - 0x110]
push eax
push 0x4e93d0
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
cdq
mov ecx, 0x64
idiv ecx
push edx
push str.Exception_02d_02d_02d._02d_02d_02d.dbg.dmp
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push 1
lea eax, [ebp - 0x110]
push eax
push 0x4e92c8
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x4e93d0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x4e92c8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047f5bc
mov esp, ebp
pop ebp
ret
Function at 0x45d980
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x4e4150]
xor eax, ebp
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x45d9bc
mov eax, 1
jmp 0x45da1d
push 0
lea ecx, [ebp - 0x40c]
push ecx
push 0x400
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45d9e8
cmp dword [ebp - 0x40c], 0
jne 0x45d9ea
jmp 0x45da0e
push 0
mov ecx, dword [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x45da0c
xor eax, eax
jmp 0x45da1d
jmp 0x45d9bc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047f5bc
mov esp, ebp
pop ebp
ret
Function at 0x45e190
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb680
push 0x481850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffed8
mov eax, dword [0x4e4150]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x45e2c8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x138]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x45e20e
mov dword [ebp - 4], 0xffffffff
jmp 0x45e2e1
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x138]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
cmp dword [ecx], 0x4550
je 0x45e23d
mov dword [ebp - 4], 0xffffffff
jmp 0x45e2e1
mov edx, dword [ebp - 0x12c]
mov eax, dword [edx + 8]
add eax, 0x7e90
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0x130]
push ecx
call fcn.0047fc19
add esp, 4
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 0x134]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x134]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x134]
mov edx, dword [ecx + 0x10]
add edx, 1
push edx
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 0x14]
cdq
mov ecx, 0x64
idiv ecx
push edx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x128]
push eax
push str._s__loaded_at_0x_08x____02d__02d__02d__02d:_02d:_02d__KR__r_n
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045e040
add esp, 0x28
mov dword [ebp - 4], 0xffffffff
jmp 0x45e2e1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0047f5bc
mov esp, ebp
pop ebp
ret
Function at 0x45e300
Capabilities:
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4e4150]
xor eax, ebp
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x104
lea ecx, [ebp - 0x138]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
ja 0x45e34a
push 0x4cadcc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x28], 0xc8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x45e378
push 0x4cadd4
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x138]
push ecx
push str._s__run_by__s._r_n
mov edx, dword [ebp + 8]
push edx
call fcn.0045e040
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push str._d_processor_s___type__d._r_n
mov eax, dword [ebp + 8]
push eax
call fcn.0045e040
add esp, 0x10
mov dword [ebp - 0x158], 0x20
lea ecx, [ebp - 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [ebp - 0x150]
add edx, 0xfffff
shr edx, 0x14
push edx
push str._d_MBytes_physical_memory._r_n
mov eax, dword [ebp + 8]
push eax
call fcn.0045e040
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0047f5bc
mov esp, ebp
pop ebp
ret