joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bc63
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x34]
mov dword [ebp - 0x38], 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 3
mov ecx, dword [ebp - 0x2c]
pop eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push 0x4000000
push 0x30363165
mov dword [ebp - 0x14], esi
call fcn.0040c831
add esp, 0x14
push esi
push 0x202
call fcn.0040d6a2
push dword [ebp - 0x2c]
push 0x203
call fcn.0040d6a2
pop edi
pop esi
leave
ret 4

Function at 0x40ca03
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x46
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x118]
mov dword [ebp - 0x11c], ebx
push 0x412f80
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 8]
push 1
pop esi
mov dword [0x412f98], eax
push esi
call fcn.0040b800
cmp eax, ebx
mov dword [0x412fa4], eax
je 0x40ca5a
push 4
call fcn.0040b800
test eax, eax
mov dword [0x412fa8], esi
je 0x40ca60
mov dword [0x412fa8], ebx
cmp dword [0x412fa4], ebx
mov dword [ebp - 0x11c], 0x11c
je 0x40caa2
cmp dword [0x412fa8], ebx
jne 0x40caa2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40caa2
cmp dword [ebp - 0x114], esi
jae 0x40ca9c
cmp dword [ebp - 0x118], 6
jb 0x40caa2
mov dword [0x412fa0], esi
push 4
call fcn.0040b800
test eax, eax
je 0x40cac2
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov dword [0x412fac], esi
jne 0x40cac8
mov dword [0x412fac], ebx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x412fb0], eax
call fcn.0040c9d1
push dword [ebp + 0xc]
call fcn.0040d4cc
push dword [ebp + 0xc]
call fcn.0040e01d
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100069fd
Capabilities:
Packed with generic packer

Disassembly:
das
nop
pushal
nop
pushfd
test esp, esp
jne 0x10006a08
mov dword [0xa167649d], 0x408b0030
or al, 0x90
popfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
nop
pushfd
test esp, esp
jne 0x10006a19
mov dword [0xc408b9d], 0x901c408b
popfd
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
nop
pushfd
test esp, esp
jne 0x10006a28
mov dword [0x23eb619d], 0xb909090
sal byte [esp + ebx - 0x80], 0x38
das
je 0x10006a3d
popfd
popal
jmp 0x10006a4f
jmp 0x10006a4f
int3
jmp 0x10017000
Function at 0x40226d
Capabilities:
Open clipboard
Packed with generic packer
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov dword [ebp - 4], 0
push 0x32
call dword [sym.imp.kernel32.dll_Sleep]
xor eax, eax
push eax
call dword [sym.imp.user32.dll_OpenClipboard]
mov ebx, eax
test eax, eax
je 0x4022e1
push 1
call dword [sym.imp.user32.dll_GetClipboardData]
mov edi, eax
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov esi, eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4022c2
push 0
push str.___________TEXT______________
call fcn.004010e1
push 0
push esi
call fcn.004010e1
jmp 0x4022e1
push edi
push esi
call fcn.00401018
test eax, eax
jne 0x4022de
push edi
call fcn.0040105f
add edi, eax
cmp byte [edi + 1], 0
je 0x4022e1
inc edi
jmp 0x4022c2
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.user32.dll_CloseClipboard]
popal
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x4022f6
Capabilities:
List tcp connections and listeners
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
lea edi, [ebp - 0x24]
push 0
push 5
push 2
push 1
lea edx, [ebp - 4]
push edx
push dword [ebp - 8]
call dword [sym.imp.iphlpapi.dll_GetExtendedTcpTable]
push 0
push 0x1c
push edi
call fcn.0040104a
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [edi], ebx
cmp ebx, 0
jne 0x402331
mov dword [edi + 0x10], esi
jmp 0x402341
mov word [edi + 4], si
cmp dword [ebp + 0x10], 0
je 0x402341
push dword [ebp + 0x10]
pop dword [edi + 8]
push 0x1c
push edi
push 1
call dword [sym.imp.user32.dll_SendInput]
call dword [sym.imp.kernel32.dll_GetLastError]
popal
leave
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x59b5511f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x16367a31
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x417e10
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0x4c3064
mov dword [0x4c6adc], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [0x4c6adc]
add ecx, eax
test esi, esi
mov dword [0x4c6adc], ecx
je 0x417e56
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x417e60
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4c6adc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add dword [0x4c6adc], eax
call fcn.00417e10
mov ecx, dword [0x4c6adc]
push str.shell32.lib
add ecx, eax
mov dword [0x4c6adc], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x10
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x417eb6
or dword [esi], 0x2000000
push str.SetCurrentProcessExplicitAppUserModelID
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, esi
pop edi
pop esi
ret

Function at 0x41df6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x63da99
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x6e9060]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp edi, 0x207
jne 0x41dfb7
call 0x4edbe8
jmp 0x41e6f1
cmp edi, 0x201
je 0x41dff0
cmp edi, 0x202
je 0x41dfe8
cmp edi, 0x204
je 0x41dff0
cmp edi, 0x200
je 0x41dfe8
cmp edi, 0x20
je 0x41dfe8
cmp edi, 0x203
jne 0x41e6f1
cmp edi, 0x204
jne 0x41dff5
call 0x4edbe8
cmp edi, 0x20
jne 0x41e016
lea eax, [esp + 0x1c]
push eax
call dword [0x6457f8]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [0x6457fc]
jmp 0x41e027
mov eax, dword [ebp + 0x10]
movzx ecx, ax
shr eax, 0x10
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
push 1
mov ecx, esi
call 0x4e89ba
xor edi, edi
push edi
mov ecx, esi
mov ebx, eax
call 0x4e89ba
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, edx
add ecx, ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x60]
and al, 0x60
Function at 0x42f0f0
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
sbb ebp, dword [edi + edi*4 - 0x1f]
inc ebp
loope 0x42f13b
mov dl, 0xd
leave
sbb esp, dword [edi + 0x58247e3b]
or dh, byte [ebx + 0x58b774cd]
xor eax, 0x217a4d2
shr byte [edi + 0x48d3d41b], 0x56
sbb ebp, edi
aam 0x86
jne 0x42f0f4
shr dl, 1
jle 0x42f16f
lodsd eax, dword [esi]
sub ah, byte [edx]
inc eax
or edx, ecx
stosd dword es:[edi], eax
dec edi
xor ecx, dword [ebx - 0x61a41e3b]
hlt
bound esp, qword [esi + ecx*4 + 0x22e0290c]
loopne 0x42f15f
sbb dword [eax - 0x7c664ef6], edx
hlt
cmpsb byte [esi], byte es:[edi]
pop edi
jb 0x42f17c
cmp edi, dword [edx + 0x785581e9]
push ss
popal
and dl, byte [eax + edx + 0x5de60359]
push ebx
imul ecx, dword [edi - 0x71], 0xb629720b
mov edi, 0x55731347
lodsd eax, dword [esi]
push 0x25
fldpi
lds ebp, [edi - 0x80]
cmp al, 0x80
xor dword [edx - 0x30], ebp
jmp 0x42f136
xchg edx, eax
jle 0x42f1aa
out dx, al
out dx, eax
imul esi, dword [ecx + 0x32d11a4c], 0x3794ef89
push ds
inc esi
jp 0x42f1df
push esi
movsb byte es:[edi], byte [esi]
and dword [ebx], ecx
push ebx
in eax, 0xaa
mov esp, 0x7e945ef6
push ds
push es
and dword [edx + 0x13], edx
cmp edx, ebx
pop esp
push ds
sbb eax, 0x2986468c
loopne 0x42f178
shl byte [ebx - 0x53], 1
lodsd eax, dword [esi]
les ebx, [ecx - 0x48f5a725]
test byte [ecx], dl
mov bh, 1
aas
loop 0x42f14b
pop ss
xor bl, ah
int 0x51
mov al, byte [0x10097f8a]
mov ecx, 0x61137870
and bl, byte [edi - 0x19f1a6f0]
fbld tbyte [eax]
jg 0x42f1ea
adc cl, bh
xor dword [eax + ecx*2 - 4], ecx
rcl al, 1
pop ebx
mov eax, dword [0x54af1f32]
or byte [ecx - 0x1342633a], dh
ret 0x5b1e
and byte [ebp + ebp*8 - 0xdf6a6d8], ch
sbb ebp, ecx
aam 0x86
push 0x93d3d0e9
test eax, 0xd32a12ef
inc edi
retf 0x4915
Function at 0x4351fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x63da99
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x6e9060]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp edi, 0x207
jne 0x435247
call 0x504e78
jmp 0x435981
cmp edi, 0x201
je 0x435280
cmp edi, 0x202
je 0x435278
cmp edi, 0x204
je 0x435280
cmp edi, 0x200
je 0x435278
cmp edi, 0x20
je 0x435278
cmp edi, 0x203
jne 0x435981
cmp edi, 0x204
jne 0x435285
call 0x504e78
cmp edi, 0x20
jne 0x4352a6
lea eax, [esp + 0x1c]
push eax
call dword [0x6457f8]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [0x6457fc]
jmp 0x4352b7
mov eax, dword [ebp + 0x10]
movzx ecx, ax
shr eax, 0x10
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
push 1
mov ecx, esi
call 0x4ffc4a
xor edi, edi
push edi
mov ecx, esi
mov ebx, eax
call 0x4ffc4a
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, edx
add ecx, ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x20]
push eax
push ecx
mov dword [esp + 0x30], edx
call dword [0x645710]
push edi
mov ecx, esi
call 0x4ffc4a
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x68]
push edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x70]
push eax
lea edx, [esp + 0x30]
push edx
Function at 0x46518e
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
push 0x63ac2f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e9060]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
mov dword [edi], 0x6a7494
mov dword [esp + 0x28], 5
mov eax, dword [edi + 0x68]
sub eax, dword [edi + 0x64]
xor ebp, ebp
sar eax, 2
xor ebx, ebx
test eax, eax
jbe 0x465230
lea esp, [esp]
mov ecx, dword [edi + 0x68]
sub ecx, dword [edi + 0x64]
sar ecx, 2
cmp ebx, ecx
jb 0x4651f0
call 0x54a0d8
mov edx, dword [edi + 0x64]
mov esi, dword [edx + ebx*4]
cmp esi, ebp
je 0x465222
mov eax, dword [esi + 0x10]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x465219
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call 0x529c15
add esp, 4
add byte [ebx + 0x4f8b04c4], al
push 0x43644f2b
mov ecx, dword [edi + 0x68]
sub ecx, dword [edi + 0x64]
inc ebx
sar ecx, 2
cmp ebx, ecx
jb 0x4651de
mov esi, dword [edi + 0x78]
cmp esi, ebp
je 0x465245
mov edx, dword [esi]
push edx
call 0x665322
push esi
call 0x6652a4
mov esi, dword [edi + 0x74]
cmp esi, ebp
je 0x46525a
mov eax, dword [esi]
push eax
call 0x665322
push esi
call 0x6652a4
mov esi, dword [edi + 0x70]
cmp esi, ebp
je 0x46521e
aad 0xf7
inc esi
invalid

Function at 0x469dce
Capabilities:
Encode data using xor

Disassembly:
imul byte [edx - 0x36]
push ebx
push eax
invalid
xlatb
je 0x469ca0
jne 0x469ca3
dec edx
invalid
cli
pop ebx
sti
pop eax
clc
pop ecx
invalid
push edi
hlt
dec edx
fstp xword [ebx - 0x25]
jnp 0x469cc9
js 0x469cce
fdivp st(6)
invalid
pop ebp
push ecx
int1
push ecx
int1
push ecx
jbe 0x469cd0
jbe 0x469cd3
ja 0x469cd5
ja 0x469cd5
aad 0xf5
cmc
push 0xfffffffffffffffa
pop edx
cli
pop edx
sti
pop eax
js 0x469ce3
jns 0x469cea
jle 0x469cec
jg 0x469cef
call [ebx + esi*8 + 0x53]
invalid
jbe 0x469cf1
xlatb
dec edx
ljmp 0x5bfb:0xda7ada7a
invalid
pop esi
jl 0x469d07
jae 0x469cff
jae 0x469d01
jae 0x469d00
hlt
clc
pop eax
clc
pop ecx
jg 0x469d19
fistp qword [esp + ebx*8 + 0x7c]
fnsave dword [edx - 0x30]
jl 0x469d18
jl 0x469d1b
jb 0x469d10
int1
push esi
fidivr dword [ebx - 0x21]
fistp qword [ebp - 0x2f]
jge 0x469d1f
jno 0x469d27
retf 0xf56a
pop edx
sti
pop ebx
jnp 0x469d35
fstp xword [eax - 0x28]
js 0x469d34
js 0x469d37
jns 0x469d39
stc
pop ecx
invalid
pop esi
invalid
pop edi
call [edi + 0x7c]
pop edi
jl 0x469d46
fdivr qword [ebp - 0x23]
jge 0x469d49
jge 0x469d4b
jp 0x469d55
jnp 0x469d57
jnp 0x469d56
js 0x469d58
clc
pop eax
clc
pop eax
clc
pop eax
stc
pop ecx
jns 0x469d63
jns 0x469d65
jns 0x469d67
jns 0x469d69
invalid
jae 0x469d59
mov esi, esi
xor bl, bh
div byte [eax]
sti
add esi, edi
loopne 0x469dcf
add bh, byte [ecx - 0x7c]
jle 0x469d60
jb 0x469d68
stosb byte es:[edi], al
or edx, 0xfe04fe04
add al, 0xfe
add al, 0x7e
xchg byte [ebp - 0x78], bh
jae 0x469d78
jbe 0x469d7e
hlt
Function at 0x47a09e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x63da99
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x6e9060]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp edi, 0x207
jne 0x47a0e7
call 0x549d18
jmp 0x47a821
cmp edi, 0x201
je 0x47a120
cmp edi, 0x202
je 0x47a118
cmp edi, 0x204
je 0x47a120
cmp edi, 0x200
je 0x47a118
cmp edi, 0x20
je 0x47a118
cmp edi, 0x203
jne 0x47a821
cmp edi, 0x204
jne 0x47a125
call 0x549d18
cmp edi, 0x20
jne 0x47a146
lea eax, [esp + 0x1c]
push eax
call dword [0x6457f8]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [0x6457fc]
jmp 0x47a157
mov eax, dword [ebp + 0x10]
movzx ecx, ax
shr eax, 0x10
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
push 1
mov ecx, esi
call 0x544aea
xor edi, edi
push edi
mov ecx, esi
mov ebx, eax
call 0x544aea
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, edx
add ecx, ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x20]
push eax
push ecx
mov dword [esp + 0x30], edx
call dword [0x645710]
push edi
mov ecx, esi
call 0x544aea
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x68]
push edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x70]
push eax
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x40], ecx
call dword [0x645704]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x64], ecx
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], edx
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x40], edi
call eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x170], edi
je 0x47a988
xor ebx, ebx
cmp eax, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
jle 0x47a2e2
mov eax, dword [esp + 0x20]
cdq
idiv dword [esi + 0x16c]
mov ecx, dword [esi + 0x54]
mov edx, dword [ecx]
mov ebx, eax
mov eax, dword [edx]
mov dword [esp + 0x10], ebx
call eax
cmp ebx, eax
jge 0x47a2e2
cmp dword [esi + 0x130], edi
je 0x47a9c4
push ebx
lea ecx, [esi + 0x134]
call 0x4b19ce
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [esi + 0x16c]
mov eax, ecx
cdq
idiv ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], esi
mov dword [esp + 0x44], 0x6a761c
sub ecx, edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x50], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0xd0], 5
call fcn.0047f7fe
mov dword [esp + 0x40], eax
mov dword [esp + 0xc0], 0xffffffff
jmp 0x47a2e2
Function at 0x47dace
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x6be0c1c0
dec eax
div byte [eax - 0x4c9eb522]
xchg edi, eax
loope 0x47db2e
dec ecx
push edi
lodsd eax, dword [esi]
xchg esp, eax
jmp [esi + ebp*8]
push esi
movsb byte es:[edi], byte [esi]
push ss
add dh, bh
loop 0x47db5e
add dh, byte [esi + 0x7a]
xchg esi, eax
invalid
test eax, 0x5796ae7a
xor bl, al
leave
xchg esp, eax
outsb dx, byte [esi]
or al, 0x36
dec esp
jmp 0x2cbdaafe
Function at 0x4bb649
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3398
cmp edx, dword [eax]
je 0x4bb66b
add eax, 8
inc ecx
cmp eax, 0x4c3428
jl 0x4bb65c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3398]
jne 0x4bb799
mov eax, dword [0x4c7d2c]
cmp eax, 1
je 0x4bb773
test eax, eax
jne 0x4bb69c
cmp dword [0x4c32c4], 1
je 0x4bb773
cmp edx, 0xfc
je 0x4bb799
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb6d3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc030
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc4c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb716
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc4c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0984
push edi
call fcn.004be390
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc030
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc040
lea eax, [ebp - 0xa0]
push 0x4c0964
push eax
call fcn.004bc040
push dword [esi + 0x4c339c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc040
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be304
add esp, 0x2c
pop edi
jmp 0x4bb799
lea eax, [ebp + 8]
lea esi, [esi + 0x4c339c]
push 0
push eax
push dword [esi]
call fcn.004bc4c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x11f1525
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xd4b38df
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10015672
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001568a
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x100156b1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
add eax, 0xfff8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1001e2fb
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001e3cf
mov dword [ebp - 0x1c], 0xea75c96d
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x8f8256a
mov dword [ebp - 0x28], 0x801fc3ee
mov dword [ebp - 0x60], 9
mov dword [ebp - 0x5c], 9
mov dword [ebp - 0x58], 9
mov dword [ebp - 0x54], 9
lea ecx, [ebp - 2]
call fcn.10008b83
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x40]
call fcn.10018155
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.1001811b
mov dword [ebp - 0x2c], 0x6890
mov dword [ebp - 0x30], 0x58f5537c
mov dword [ebp - 0xc], 0
jmp 0x1001e389
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x1001e39c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x38], 1
jmp 0x1001e382
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001e3b0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x38]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x38], eax
lea ecx, [ebp - 0x4c]
call fcn.10018141
jmp 0x1001e41a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001e3fd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1001e41a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10018146
mov dword [eax], 0x3ed23c5a
jmp 0x1001e3f2
mov esp, ebp
pop ebp
ret