joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48805b
Capabilities:
Encode data using xor

Disassembly:
cmc
mov bh, 0xf
out dx, eax
mov bh, 0x1c
stc
mov ch, 0x18
pxor mm6, qword [edi + 0x18b5f91c]
mov byte [edi + 6], bl
xchg ecx, eax
sbb ebp, ebp
push esp
jb 0x48805d
dec ecx
sbb eax, 0xeb6758f3
inc ecx
xor byte [ebp + 0x2ab36e16], cl
cmp esi, esi
pop ebx
cmp ebx, esi
dec ebp
inc ebp
out dx, al
xor ecx, dword [ebp + 0x49]
and eax, 0x89274784
push ecx
das
test byte [edi + 0x27], al
mov dword [ecx + 0x2f], edx
mov dword [esi], edi
sub eax, 0xc77f3298
sub ch, byte [edx - 0x39]
or eax, 0x6b3ec366
fstp xword [ecx + 0x34]
xchg ebx, eax
imul ecx, dword [ecx], 0x3ccd9130
lahf
int 0x5c
int1
xchg esi, eax
jnp 0x488088
xchg ebx, eax
insd dword es:[edi], dx
cwde
ret

Function at 0x48896a
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x54
popal
stosb byte es:[edi], al
or dl, byte [edi - 0x6a]
push edi
adc eax, 0xe92f55fe
and dword [edx], esi
lahf
sub byte [ecx - 0x1b], al
pop ecx
xor bl, byte [edi + 0x59e54128]
and bl, ah
pop edx
and al, dh
dec ebx
and eax, 0xee3c49e2
adc esp, dword [ebx - 0x32]
push es
jnp 0x488978
add bh, byte [edi - 0x2e]
movq qword [ebp + 0x638d3a6e], mm2
or bh, byte [ebx + 0x36cb6b3e]
popal
invalid

Function at 0x48a8f7
Capabilities:
Encode data using xor

Disassembly:
lds esp, [esi]
invalid
inc edi
or bl, byte [esp + ecx + 0x510eb941]
scasb al, byte es:[edi]
pop edx
push ebx
mov al, byte [0x23e8761d]
sbb eax, 0x7e23e876
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x7e23e876
cmpsb byte [esi], byte es:[edi]
sbb eax, dword [edx - 0x1d]
push esp
out dx, eax
pop esp
and byte [edi + 0x498b2658], bl
and al, 0x89
inc ebp
cmp cl, byte [edi + edx*2 + 0x3a418523]
sub byte [edx + 0x27], 0x82
push 0x5a
xchg ecx, eax
je 0x48a964
cld
aas
add byte [eax], 0x21
wait
imul eax, ecx, 0xffffff86
adc eax, 0xbf7e93dd
xchg ebx, eax
jle 0x48a8eb
sar byte [ecx*4 - 0x6a309208], 0x6b
lds edi, [edi + 0x1ec5dc1b]
stosd dword es:[edi], eax
mov ebx, 0x75b9d673
invalid
inc eax
mov ebx, 0xb9dd20e9
sbb eax, 0xbc094ff5
pop ds
dec ebp
fdiv qword [ecx + 0x19]
cmc
dec edi
or dword [edi + ebx + 0x1971dc4d], edi
push esi
jo 0x48a929
adc eax, 0x7a05b255
out 0x3f, al
jp 0x48a95d
aas
je 0x48a923
sbb dh, byte [edi + edx*4]
xor al, 0x97
or bh, byte [edx - 0x49]
aaa
clc
pop edx
cmp ecx, dword [eax + 0x548c335c]
xchg ebp, eax
pop ebp
cmp byte [ecx + 0x4f833856], bl
cmp dword [ebp + 0x73853c6e], edx
xor al, byte [ebx + 0x1b802506]
push eax
cdq
push esi
cmp byte [ebx + 0x6e95394f], al
cmp al, 0x85
jae 0x48a9cc
add dword [esi], 0x25
sbb byte [ebx], 0x50
xchg ecx, eax
imul ebp, dword [esi], 0xfffffffc
jne 0x48a975
xchg edi, eax
insd dword es:[edi], dx
shl cl, cl
jno 0x48a97b
mov cl, byte [ebx]
pushfd
sar byte [ecx], 1
lodsb al, byte [esi]
xor dword [ebx - 0x3e], 0xcfd379bf
push 0xcf1fc2a9
scasd eax, dword es:[edi]
jp 0x48a98e
mov eax, dword [0xfb5d371]
mov ah, 0xb3
adc dh, byte [ebp + 0x4dec9049]
nop
in al, dx
dec ebp
mov bl, 0xec
inc ebp
test ch, ah
inc ecx
invalid
Function at 0x48b142
Capabilities:
Encode data using xor

Disassembly:
sti
push edi
adc esi, edx
inc edi
aas
stc
push ebx
dec edi
call 0x5d2dd335
and ah, ch
pop esp
sub dh, bl
dec ebp
daa
loope 0x48b13d
cmp bh, cl
pop ebp
xor ecx, dword [eax + 0x458b3151]
pop ebp
xchg dword [ebp + 0x22], ebx
sbb dword [edi - 0xe], edi
or al, 0x7d
shr byte [ecx], cl
bound ecx, qword [ebp + 0xae82a67]
xor al, 0x8d
pushal
and dword [ebx + 0x1486ad75], ebx
scasb al, byte es:[edi]
lahf
jno 0x48b0ef
test dword [edi - 0x27], edi
int1
jae 0x48b0fb
mov ds, word [ebx]
xchg eax, esi
sub ah, byte [eax - 0x4b55cc08]
adc eax, 0xb96cdfab
cmp dword [edi - 0xd7b8946], ebx
cmp dword [edi - 0xd7b8946], ebx
stosd dword es:[edi], eax
fild qword [ecx + edi*4 - 0xe]
cmp dword [edi - 0xd7b8946], ebx
pop edx
adc bl, 0x14
lodsb al, byte [esi]
loop 0x48b1a7
test al, ch
je 0x48b121
ret 0xbe58
xor byte [ecx - 0x1b2dd536], dl
add dl, ah
loope 0x48b1d8
sub dl, dl
in al, 2
aam 0xe1
sub cl, byte [edi - 0xc6dd136]
or al, 0xb7
mov eax, dword [0x26c9dc77]
xchg ebx, eax
call 0x10ff6e2a
cdq
in eax, 0x34
mov cl, ah
outsd dx, dword [esi]
mov cl, ah
pop eax
mov ebp, esp
dec eax
lds edi, [esi + 0x9b3db0c]
in al, dx
adc dword [eax - 0x4f], 0xedbf5ced
cmp al, 0xd1
mov esp, 0xdb3f91a
invalid
mov edi, 0xbcd13ced
sbb bh, cl
mov bl, 0xd
mov eax, 0x75d841e3
adc eax, 0xb86152ef
pop ss
push ecx
stosb byte es:[edi], al
or ecx, dword [ebx + ecx*4]
sbb eax, dword [eax - 0x41]
adc byte [ebx - 0x54], bl
adc byte [edx - 0x5d], dh
adc al, 0x34
mov dword [edx], ecx
ja 0x48b1a4
sbb dword [edi - 0x1f], edi
pop eax
mov word es:[esi + 0x2d], ds
sub dword [edx + 0x1b], 0xffffffc8
sbb ecx, eax
adc dword [ebp - 0x24], edi
add ah, byte [eax - 0x46]
imul esi, dword [ebx + 0x29], 0xffffff92
push esp
fidiv word [edx]
fdivr st(7), st(0)
dec ecx
sti
rcr dword [ecx - 0x53b7d304], 0xe8
sbb byte [esi + esi*2 + 0x6ba3afab], cl
aas
jmp 0x48b20a

Function at 0x48e69e
Capabilities:
Encode data using xor

Disassembly:
int3
aas
xchg edx, ebp
sub al, byte [edi - 0x17cd933]
sub ebx, dword [ebx - 0x56268a47]
jg 0x48e62a
lahf
pop edx
xchg edi, esi
push edx
test ebx, edi
out dx, eax
mov esi, 0x7add00d
shl esp, 0x57
mov ch, 0x84
cmp ecx, esp
mov ebx, 0x5ffc8f1e
mov esp, 0xe6b67dac
dec esi
cli
das
dec eax
mov eax, dword [0x5ba54918]
pop ss
out dx, eax
dec ecx
add ebx, dword [edi + 0x6ae7358]
lahf
pop eax
jae fcn.0048e622
push es
jo 0x48e633
mov esp, 0x2a27e01
daa
add dword [esi - 0x5e], edi
add ah, byte [edi]
stc
inc eax
pop edi
lodsb al, byte [esi]
add esp, dword [ebx - 3]
push edi
cmp bh, cl
pop eax
xor ecx, dword [eax + 0x379b2147]
mov byte [edi + 0x21], al
wait
aaa
inc edi
and dword [ebx + 0x51ff2037], ebx
and bh, bh
push ecx
sub eax, 0x953b418e
or eax, 0x276bf526
and dword [edx + 0x37], 0xffffff8f
imul esp, dword [ebx], 0x9f4778ff
jne 0x48e670
lahf
jae 0x48e676
xchg dword [ebx], eax
aam 0xe3
jl 0x48e688
xchg edx, eax
js 0x48e689
xchg ecx, eax
imul esp, dword [edi - 0x4234f050], 0x74
ret
Function at 0x40317d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417e94]
sub esi, dword [0x40be00]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x42920c], eax
jle 0x4032e7
push dword [0x41fea4]
call fcn.0040330f
push ebx
push ebx
push dword [0x40be00]
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41fea0], esi
mov dword [0x417e90], ebx
mov ebp, 0x40be90
mov eax, dword [0x417e98]
mov edi, 0x4000
sub eax, dword [0x41fea4]
cmp eax, edi
jg 0x4031f2
mov edi, eax
mov esi, 0x413e90
push edi
push esi
call fcn.004032f9
test eax, eax
je 0x4032d9
add dword [0x41fea4], edi
mov dword [0x40be20], esi
mov dword [0x40be24], edi
cmp dword [0x429210], ebx
je 0x403249
cmp dword [0x4292a0], ebx
jne 0x403249
mov eax, dword [0x41fea0]
push ebx
sub eax, dword [0x417e94]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40be00]
mov dword [0x417e90], eax
call fcn.00402d1a
pop ecx
mov ecx, 0x40be08
mov dword [0x40be28], ebp
mov dword [0x40be2c], 0x8000
call fcn.004063ee
test eax, eax
jl 0x4032e2
mov esi, dword [0x40be28]
sub esi, ebp
je 0x4032a3
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4032de
cmp esi, dword [esp + 0x10]
jne 0x4032de
add dword [0x40be00], esi
cmp dword [0x40be24], ebx
jne 0x403218
jmp 0x4032af
cmp dword [0x40be24], ebx
jne 0x4032e2
cmp edi, ebx
je 0x4032e2
mov eax, dword [0x417e94]
mov ecx, eax
sub ecx, dword [0x40be00]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4031dc
push ebx
push ebx
push eax
push dword [0x40901c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4032e7
or eax, 0xffffffff
jmp 0x4032f1
push 0xfffffffffffffffe
jmp 0x4032e4
push 0xfffffffffffffffd
pop eax
jmp 0x4032f1
push 1
call fcn.00402d1a
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x40378d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4037c8
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4037af
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4037c0
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4037ca
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4037a5
xor eax, eax
pop edi
pop esi
ret
Function at 0x10005573
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10005582
pop dword [ebp - 8]
mov eax, 0xf34475df
add eax, 0x1cbbdfa3
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3cb9b
push 0
mov eax, 0xea6741f2
add eax, 0x2599ef4a
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xc373d251
sub ecx, 0xc3737bc1
mov ebx, eax
mov edx, 0x1001fe00
add edx, dword [ebp - 8]
mov edi, 0x354b663c
add edi, 0x8c19165c
add dword [ebp - 4], eax
mov esi, dword [edx]
xor esi, edi
sub dword [ebp - 4], 0xb4428a47
mov dword [ebx], esi
mov dword [ebp - 4], 0xaffaf8d9
add ebx, 0xa38f3c75
add ebx, 0x5c70c38f
add edx, 0x74466b95
sub edx, 0x74466b91
loop 0x100055db
add eax, 0x8589997e
add eax, 0x7a77b395
mov ebx, eax
add eax, 5
mov ecx, 0x76228963
sub ecx, 0x66228963
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x417c14
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417a8a
Function at 0x41615c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41619b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41619b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41619b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41619b
cmp dword [ecx + 0x74], 0xe
jbe 0x41619b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428e0a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00428c80

Function at 0x435320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43534d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43534d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x402dc8
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xae
mov eax, 0xb7c9fb98
xor dh, byte [edi - 0x1a4f04be]
mov bl, 0x86
pop ecx
pushal
dec eax
invalid
ficom dword [ebx]
or eax, 0x39fc2509
adc bh, 0x83
scasb al, byte es:[edi]
jbe 0x402d36
js 0x402d7a
fisubr dword [edx + 0x4744d3b0]
test cl, bh
out 0x4f, al
mov dword [0x9eafd3ab], eax
aad 0x21
ret
je 0x402d5f
jmp 0xf2a975f0
Function at 0x672460
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 5
je 0x67247b
push eax
push esi
call fcn.00672aa0
add esp, 8
test eax, eax
jle 0x6724c3
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.005a6ec0
add esp, 8
test edi, edi
jg 0x6724c0
push edi
call fcn.005ef110
add esp, 4
test eax, eax
je 0x6724c0
push 0xa
push esi
call fcn.005a7620
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0

Function at 0x4010c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
xor eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, str.LoadLibraryA
mov eax, dword [eax]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x18]
call section..text
push str.msvcrt.dll
call eax
add esp, 4
test eax, eax
je 0x40110b
mov edx, str.printf
mov ecx, eax
call section..text
push str.Hello_world__n
call eax
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401cb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x10], 0
push ebx
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10c], ebx
je 0x401ce7
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403107
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.004063c0
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea esi, [ebp - 0x108]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401d21
sub esi, ecx
lea edi, [esi + 6]
cmp esi, edi
jge 0x401d5f
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
xor edx, edx
mov ecx, 0x1a
div ecx
push 1
add dl, 0x61
mov byte [ebp + esi - 0x108], dl
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, edi
jl 0x401d37
mov ebx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401d68
mov edx, dword [str..exe]
mov cl, byte [0x40eafc]
mov dword [eax], edx
mov byte [eax + 4], cl
lea eax, [ebp - 0x108]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401d90
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00403107
mov esp, ebp
pop ebp
ret

Function at 0x401db0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push esi
jmp loc.00418a16
Function at 0x51002dec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.510043f0
test esi, esi
jne 0x51002e23
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.510044e0
jmp 0x51002e44
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.51002c88
mov dword [esp], eax
test esi, esi
je 0x51002e44
cmp dword [ebx], 0
je 0x51002e44
dec esi
jmp 0x51002e2b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x510034d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5105f020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x51003570
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x51003550
xor eax, eax
push ebp
push 0x51003549
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x5100358c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51003550
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x5105f020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5105f020], ax
mov esp, ebp
pop ebp
ret

Function at 0x5100426c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x51061048], 0
je 0x510042cd
cmp word [0x5106121c], 0xd7b2
jne 0x51004295
cmp dword [0x51061224], 0
jbe 0x51004295
mov eax, 0x51061218
call dword [0x51061234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x5105f06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x510042f4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5105f030], 0
jne 0x510042e9
push 0
push 0x5105f064
push 0x5105f06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x51006070
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x510060d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.51004660
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.5100309c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x510060c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510060dd
lea eax, [ebp - 0x10]
call fcn.510043f0
ret

Function at 0x51008ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.510048b0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x51008af9
test al, 0x10
jne 0x51008afd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret