joyce8/EMBER2024-capa huggingface dataset:
Function at 0x615323
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov esi, ecx
call ebx
sub eax, dword [esi + 0x6c]
xor edi, edi
cmp eax, 0x7530
jbe 0x615360
mov eax, dword [esi + 0x60]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x64]
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x58], eax
mov dword [esi + 0x64], edi
call ebx
mov dword [esi + 0x6c], eax
mov ecx, dword [esi + 0x5c]
test ecx, ecx
jne 0x61536c
mov eax, dword [esi + 0x54]
jmp 0x6153b8
push 0xa
pop ebx
mov dword [ebp - 4], edi
test edi, edi
jne 0x6153b6
or eax, 0xffffffff
mov edi, dword [esi + 0x54]
xor edx, edx
div ebx
cmp edi, eax
jbe 0x61538e
shr edi, 1
shr ecx, 1
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], ecx
mov eax, dword [esi + 0x54]
xor edx, edx
mov ecx, dword [esi + 0x5c]
imul eax, ebx
div ecx
xor edx, edx
imul eax, eax, 0x3e8
div ebx
imul ebx, ebx, 0xa
mov edi, eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 3
jb 0x615372
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x65bdb2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065b9b7

Function at 0x65bdbd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065bb38

Function at 0x6600c1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065f8a6

Function at 0x6600cc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065fae1

Function at 0x660d95
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00660b1c
Function at 0x407560
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x8166ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4047bc
call fcn.00409662
push 4
mov dword [esp + 0x18], 0
call fcn.0040ad82
mov edi, eax
add esp, 4
test edi, edi
je 0x4075d4
push ebx
call fcn.0040945d
mov dword [edi], eax
call fcn.0040921c
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409623
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4075c8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040964b
pop ebx
jmp 0x4075d6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40bc71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x82c3dc]
jne 0x40bc7b
repz ret
jmp fcn.0041331c
Function at 0x41893c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x82c3dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411403
and dword [ebp - 0x14], 0
cmp dword [0x82e9e8], 0
mov dword [ebp - 0x18], eax
jne 0x4189ef
push 0x403a3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418a97
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403a30
push ebx
call edi
test eax, eax
je 0x418a97
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403a20
push ebx
mov dword [0x82e9e8], eax
call edi
push eax
call esi
push 0x403a0c
push ebx
mov dword [0x82e9ec], eax
call edi
push eax
call esi
push 0x4039f0
push ebx
mov dword [0x82e9f0], eax
call edi
push eax
call esi
mov dword [0x82e9f8], eax
test eax, eax
je 0x4189ef
push 0x4039d8
push ebx
call edi
push eax
call esi
mov dword [0x82e9f4], eax
mov eax, dword [0x82e9f4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418a48
cmp dword [0x82e9f8], ecx
je 0x418a48
push eax
call esi
push dword [0x82e9f8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418a48
test ebx, ebx
je 0x418a48
call edi
test eax, eax
je 0x418a3f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x418a3f
test byte [ebp - 8], 1
jne 0x418a48
or dword [ebp + 0x10], 0x200000
jmp 0x418a7b
mov eax, dword [0x82e9ec]
cmp eax, dword [ebp - 0x18]
je 0x418a7b
push eax
call esi
test eax, eax
je 0x418a7b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x418a7b
mov eax, dword [0x82e9f0]
cmp eax, dword [ebp - 0x18]
je 0x418a7b
push eax
call esi
test eax, eax
je 0x418a7b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x82e9e8]
call esi
test eax, eax
je 0x418a97
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418a99
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bc71
leave
ret
Function at 0x814b70
Capabilities:
Accept command line arguments
Delete directory
Get common file path

Disassembly:
mov eax, 0x1420
call fcn.00419a50
cmp dword [0x26618fc], 0x37
jne 0x814c27
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x404218
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x824]
push eax
push 0x404230
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0xc20]
push edx
push 0
push 0x404288
push 0x4042a0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x404348
push 0x4043f0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov eax, dword [0x2666b2c]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x26618f4]
mov byte [eax + esi], dl
add esp, 0x1420
ret

Function at 0x814c50
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x64
mov edx, dword [0x82d8f0]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx]
push ebx
mov ebx, dword [0x82d8f8]
push ebp
mov ebp, dword [0x82d8fc]
push esi
mov esi, dword [ecx + 4]
mov dword [esp + 0x1c], edx
mov edx, dword [0x82d8f4]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0xc6ef3720
mov dword [esp + 0x28], 0x9e3779b9
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0x20
jmp 0x814ca4
mov eax, dword [esp + 0x18]
mov edx, eax
mov edi, eax
shr edx, 5
shl edi, 4
add edi, ebx
add edx, ebp
xor edx, edi
mov edi, dword [esp + 0x10]
add edi, eax
xor edx, edi
sub esi, edx
mov eax, esi
shl eax, 4
mov dword [0x26618f8], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
add dword [esp + 0x14], eax
mov edi, dword [esp + 0x10]
add edi, esi
cmp dword [0x26618fc], 0x1be
jne 0x814d00
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esp + 0x78]
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x24]
mov dword [0x2661900], 0xff6b3619
xor edx, edi
xor dword [esp + 0x14], edx
mov dword [0x2661904], 0xffffffff
mov eax, dword [esp + 0x14]
sub dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x10], eax
dec dword [esp + 0x1c]
jne 0x814ca0
cmp dword [0x26618fc], 0x8d4
jne 0x814d6b
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x64
ret 4
mov edx, dword [esp + 0x18]
pop edi
mov dword [ecx + 4], esi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
add esp, 0x64
ret 4
Function at 0x40368d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40369c
pop dword [ebp - 0x38]
mov eax, 0xa377d517
add eax, 0x5cc86185
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa4841b96
sub dword [ebp - 0x48], 0x5631d64b
mov dword [ebp - 0x44], 0xeb505f90
sub dword [ebp - 0x44], 0xb91d134b
mov dword [ebp - 0x40], 0x960ce066
sub dword [ebp - 0x40], 0x49c09c38
mov dword [ebp - 0x3c], 0xe61ff91
sub dword [ebp - 0x3c], 0xe61ff91
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8c8be17f
sub dword [ebp - 0x48], 0x18197829
mov dword [ebp - 0x44], 0xa56243c0
add dword [ebp - 0x44], 0x9c0a1db5
mov dword [ebp - 0x40], 0xd99c49b4
sub dword [ebp - 0x40], 0x762cdd48
mov dword [ebp - 0x3c], 0x3658bed2
sub dword [ebp - 0x3c], 0x3658bed2
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x43803bb
sub eax, 0x3f7939b
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x341c9
push 0
call eax
mov ecx, 0xc4855ce0
add ecx, 0x3b7adcb9
xor esi, esi
add esi, eax
mov edi, 0x1b3c2d13
sub edi, 0x1afb6513
add edi, dword [ebp - 0x38]
mov edx, 0xa670c64f
add dword [ebp - 0x18], edi
mov ebx, dword [edi]
xor dword [ebp - 0x28], 0x6d0555f3
add ebx, edx
add dword [ebp - 0x1c], edx
mov dword [esi], ebx
add dword [ebp - 0x1c], edi
add esi, 4
add edi, 0x3b2cdd0a
add edi, 0xc4d322fa
loop 0x4037b5
add eax, 0xd937
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040368d
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.0040368d
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x4047c0
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406a17
call fcn.004054fb
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x404937
push str.__alloweddir
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x404930
cmp dword [ebx + edi*4], 0
je 0x404923
push esi
push str.__alloweddir
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404923
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x40491d
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x40491d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40491d
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40491d
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.0040368d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x40490e
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x40490e
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x40490e
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x40490e
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404ac6
mov byte [ebp - 0x231], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401788
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x404826
push ebx
call dword [sym.imp.kernel32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.004054b6
ret

Function at 0x404b63
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.0040368d
pop ecx
push 2
call dword [sym.imp.kernel32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
call fcn.004047c0
test al, al
jne 0x404b92
xor eax, eax
inc eax
jmp 0x404ba1
push esi
call fcn.004049c0
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10
Function at 0x404df0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x4091c0]
cmp ax, 0xcb
je 0x404eef
cmp ax, 0xcc
je 0x404eef
mov edx, dword [0x40c5c0]
test edx, edx
je 0x404e22
mov eax, dword [0x40c470]
call edx
mov ebx, eax
jmp 0x404e27
mov ebx, 0x40c474
cmp word [0x40c460], 0
jle 0x404e4a
mov eax, 0x40c440
call fcn.00405060
mov eax, ebx
call fcn.004049d0
mov eax, ebx
call fcn.00404a50
mov esi, dword [ebx]
jmp 0x404e6d
mov edi, dword [esi + 4]
test byte [esi], 1
jne 0x404e68
mov edx, esi
mov eax, ebx
call fcn.00403e50
jmp 0x404e6b
and dword [esi], 0xfffffffe
mov esi, edi
test esi, esi
jne 0x404e50
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x40c460], 0
jle 0x404eef
mov edx, 0x40c380
mov eax, ebx
call fcn.00403fa0
mov esi, eax
test eax, eax
je 0x404ec2
mov eax, dword [0x40c414]
mov dword [esi + 0xc], eax
cmp dword [0x40c414], 0
je 0x404eb7
mov eax, dword [0x40c414]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x94]
mov dword [0x40c414], eax
sub word [0x40c460], 1
cmp word [0x40c460], 0
sete bl
mov eax, 0x40c440
call fcn.00405070
test bl, bl
je 0x404eef
mov eax, 0x40c440
call fcn.00405050
pop edi
pop esi
pop ebx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.004047b5
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.004047b5
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.004047b5
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.004047b5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.004047b5
mov dword [0x41203c], eax
call fcn.004047b5
test eax, eax
jge 0x402550
push 8
call fcn.004047b5
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.004047b5
pop ecx
push 1
call fcn.004047b5
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.004047b5
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.004047b5
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.004047b5
jmp 0x402495

Function at 0x4047b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4047c4
pop dword [ebp - 0x20]
mov eax, 0x4047c4
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3a8f8
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x34c37059
sub ecx, 0x34c322fd
xor esi, esi
add esi, eax
mov edx, 0x7809c450
add edx, 0x88377774
add edx, dword [ebp - 0x20]
mov ebx, 0x63ad0c77
add dword [ebp - 0x14], eax
mov edi, dword [edx]
xor dword [ebp - 4], 0x95271058
xor edi, ebx
sub dword [ebp - 0x1c], edx
mov dword [esi], edi
sub dword [ebp - 0x18], 0x20f8a86e
add esi, 0xdbbaba5e
sub esi, 0xdbbaba5a
add edx, 0x1e690875
sub edx, 0x1e690871
loop 0x404815
add eax, 0x12843
xor ebx, ebx
add ebx, eax
add eax, 0x805f533a
sub eax, 0x805f5335
mov ecx, 0xa7c9af33
add ecx, 0x587650cd
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4012b0
Capabilities:
Encode data using xor

Disassembly:
and eax, esi
dec edx
imul edx, ebx
jb 0x4012ba
mov dl, ch
mov dl, ch
xchg bl, dl
mov ebx, eax
imul ebx, ebp, 0xe0fc977f
xchg ebx, ebx
ja 0x4012cf
movsx ebx, ah
adc ebx, edx
mov bh, al
imul ebx, edi, 0x7bc34e06
mov edx, ecx
inc ebx
imul ebx, ebx
mov ebx, 0x41eac91d
push edx
dec ebx
mov ebx, 0x6db76a59
xchg ebx, ebx
pop ecx
imul ebx, edi, 0xaedb901a
dec ebx
mov bh, 0xfc
jmp 0x4012fa
push ecx
mov ebx, ebx
test ebx, 0xabd109b3
cmp bl, al
pop edi
imul edx, ebp
inc ebx
push edi
mov ecx, esi
pop ebp
inc ebx
test esi, 0x75466d41
dec edi
mov eax, ebp
imul ebx, eax, 0x9b6efc0c
inc edx
imul ebx, ecx
test ch, ah
sub esi, eax
cmp ebx, 0xf9ac0dba
movsx ecx, si
or edx, esi
imul edx, edx, 0
mov cl, al
adc ecx, ecx
sbb eax, 0xb26c4057
movzx ebx, dl
test bh, al
test dl, dh
add edx, 1
mov ch, dl
imul esi, ebx, 0xc3a58523
xor ah, 0xf5
xchg bh, bh
mov bl, bh
mov ah, 0x8a
mov al, 0x58
lea ebx, [0x224af738]
and ah, al
cmp edx, 0x255
jb 0x401339
pop ebx
xchg edx, ebp
or al, 0x2a
mov ebp, 0x9f00633e
push 0x4d0210
push 0x7e53e8
adc edx, ebx
xor eax, 0xf8bfc56c
adc edi, 0x89d3a158
je 0x40139f
test eax, edx
mov edx, ebx
jb 0x4013ab
test bl, cl
lea esi, [0xc01ae827]
xchg esi, esi
xor dh, 0xdb
xor dh, al
Function at 0x401de0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov eax, dword [0x410e60]
test eax, eax
jne 0x401ec0
test ebx, ebx
jne 0x401ef0
mov edx, dword [0x410dec]
test edx, edx
je 0x401e85
mov dword [esp], str._s:__s_n
mov eax, 0x410860
mov ebx, 0x406010
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
call sub.msvcrt.dll_printf
cmp byte [0x410c60], 0
je 0x401e77
mov eax, dword [0x410e60]
test eax, eax
jne 0x401fab
mov dword [esp], 0
mov eax, 1
xor edx, edx
mov dword [esp + 0x14], eax
xor ecx, ecx
mov eax, str.open
mov dword [esp + 0x10], edx
mov ebx, 0x410c60
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov eax, dword [0x410e60]
test eax, eax
jne 0x401eb1
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], 0
mov edx, 0x406010
mov ecx, 0x410860
mov dword [esp + 8], edx
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], ecx
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
jmp 0x401e2b
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], eax
mov ecx, 0x410860
mov edx, str.Error_msg:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_fprintf
test ebx, ebx
je 0x401e03
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], ebx
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x18], eax
lea edx, [ebp - 8]
mov eax, 0x400
mov dword [esp + 0x10], edx
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x1300
call sub.KERNEL32.dll_FormatMessageA
mov edx, dword [0x410e60]
sub esp, 0x1c
test edx, edx
jne 0x401fca
mov ecx, 0x410860
nop
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x401f40
and edx, 0x8080
jne 0x401f66
shr eax, 0x10
add ecx, 2
add al, al
mov eax, ecx
mov ecx, 0xa0a
sbb eax, 3
sub eax, 0x410860
mov word [eax + 0x410860], cx
mov byte [eax + 0x410862], 0
mov ebx, dword [ebp - 8]
mov dword [esp], 0x410860
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcat
mov edx, dword [ebp - 8]
mov dword [esp], edx
call sub.KERNEL32.dll_LocalFree
sub esp, 4
jmp 0x401e03
mov dword [esp], eax
mov edx, 0x410c60
mov ecx, str.Open_URL:_t_s_n
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fprintf
jmp 0x401e41
mov ecx, dword [ebp - 8]
mov ebx, str.Error:_t_t_s_n
mov dword [esp + 4], ebx
mov dword [esp], edx
mov dword [esp + 8], ecx
call sub.msvcrt.dll_fprintf
jmp 0x401f33
Function at 0x402680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x104
mov ebp, esp
push edi
xor eax, eax
xor edi, edi
push esi
push ebx
sub esp, 0x25c
lea ebx, [ebp - 0x23c]
mov dword [esp + 8], edx
mov esi, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [ebp - 0x248], esi
lea esi, [ebp - 0x128]
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp + 0x10], ebx
mov ecx, dword [ebp - 0x248]
xor edx, edx
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], 0x80000002
and ecx, 0x100
or ecx, 0x20019
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x402710
mov esi, 1
mov dword [0x410de4], esi
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
lea ebx, [ebp - 0x238]
mov ecx, 0x104
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp + 0x10], ebx
lea ecx, [ebp - 0x240]
mov eax, 0x104
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x244]
mov dword [ebp - 0x240], eax
mov ebx, str.JavaHome
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4027cd
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx ebx, byte [edx + ebp - 0x238]
mov byte [edx + ebp - 0x128], bl
inc edx
test bl, bl
jne 0x402780
test byte [ebp - 0x248], 2
je 0x4027c3
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp byte [eax + esi - 1], 0x5c
je 0x4027b2
mov word [eax + esi], 0x5c
mov dword [esp], esi
mov edi, 0x4071e0
mov dword [esp + 4], edi
call sub.msvcrt.dll_strcat
mov dword [esp], esi
call fcn.00402570
mov edi, eax
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
test edi, edi
je 0x4026f4
mov dword [esp + 4], esi
mov dword [esp], 0x4104a0
call sub.msvcrt.dll_strcpy
jmp 0x4026ff