joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abd07
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffffa67c, 0x62
lodsd eax, dword [esi]
xor dword [edx + 0x6626273b], ebp
invalid
daa
invalid
lds esp, [esi - 0x2f]
xchg esi, eax
loope 0x4abc3d
cmp dl, al
invalid
loope 0x4abc48
add dword [edx + 0x66], 0xffffffe5
pop edi
hlt
push edi
retf 0x663d
out 0x1e, eax
std
mov al, 0x90
clc
inc esi
adc al, 0xa5
test al, 0x60
mov ecx, 0x95413b7
mov dh, 0xe5
jae 0x4abc17
jno 0x4abc3b
adc esp, 0x962ed1dc
jno 0x4abc80
jae 0x4abc0f
add esp, dword [edx]
jae 0x4abce7
xchg edx, eax
dec esp
add al, 0xc6
cmp al, 0x3f
xor bh, byte [ebp + 0x2815a84e]
cmp edx, edi
mov ebx, 0x78026eb8
cmp eax, 0xa3d01aa4
sahf
and eax, 0x58169049
je 0x4abc4e
je 0x4abc2a
aam 0x25
iretd
adc byte [ecx], cl
salc
xor esp, dword [ebp + esi + 7]
hlt
cmp esp, dword [ecx - 0x68]
outsb dx, byte [esi]
mov dword fs:[0xd317a515], eax
in al, dx
mov edx, 0xf6c3cf1e
cli
xchg esi, eax
adc esp, eax
adc edi, dword [esi + 0x19b48df9]
mov ch, 0xcd
sub al, 0x6b
sub esi, ebx
int 0x2c
imul ebp, dword [ecx], 0xffffffde
push edx
jnp 0x4abc8c
leave
dec ecx
jnp 0x4abc9b
mov byte [ecx + 0x16], ah
add byte [esi], ah
invalid
fiadd dword [eax + ebp]
in al, 0x6d
jae 0x4abccc
test eax, 0x5eee524b
dec ebx
push edx
out dx, al
pop esi
cmp cl, dl
push es
push ebp
mov bh, 0x34
xor byte [esi], bl
jns 0x4abd0f
mov ecx, 0xcdb29e60
cmc
push esp
aad 0x52
invalid

Function at 0x4b1f76
Capabilities:
Encode data using xor

Disassembly:
pop esp
adc byte [edx - 0x64], 0x4f
and byte [0x53277a98], bl
leave
call dword [ecx + 0x18fd0e31]
add al, 0xd4
fist word [edi + 0x5f]
sub eax, 0xfcae5b3b
sbb ah, byte [eax]
xor dword [ebx + 0x1c837290], esp
and byte [ecx], dh
mov dword [0x1c837290], eax
xchg edi, eax
out 0x52, al
lahf
pop edi
retf
pushfd
pop esi
jp 0x4b1f11
invalid
fistp qword [edi + 0x4dc67ac2]
pop ebx
cmpsd dword [esi], dword es:[edi]
jne 0x4b1ef4
cdq
cmpsb byte [esi], byte es:[edi]
jg 0x4b1fa7
int1
cmpsd dword [esi], dword es:[edi]
sbb eax, ebx
int1
xchg ebx, eax
mov ebx, 0x40bd43b
xchg ecx, eax
dec byte [eax + edx*8 - 0x4899cb0]
cmpsb byte [esi], byte es:[edi]
or ch, ch
jl 0x4b1f70
inc eax
int1
pushal
mov dword [0x27441840], eax
and al, 0xfa
mov ch, 0xcd
rcl dword [ebx + ebx], 0x18
inc eax
or dh, byte [ecx + 0x54]
wait
mov bl, 0x56
insb byte es:[edi], dx
insb byte es:[edi], dx
push ebx
mov esi, 0x2309cee5
daa
jge 0x4b1f10
lodsd eax, dword [esi]
adc esp, ebx
ja 0x4b1f2a
push ds
popal
js 0x4b1f34
fst dword [ebp + 0x72c9fc9e]
sbb ebp, dword [esi + esi]
dec ebx
push edi
rol byte [ebx], 1
fnstsw word [ebp + 0x3b]
pop edi
xor al, 0x7f
add ebp, esi
loop 0x4b1fe5
ror byte [eax - 0x15269fec], 0x3d
invalid
lds edi, [esi]
cli
pop esp
movsd dword es:[edi], dword [esi]
ror edx, cl
fild word [ebp - 0x6f9a93f9]
adc ch, byte [ecx - 0x3b]
sub byte [edi + 0x29208c45], 0x83
sbb al, dh
invalid
inc ebp
imul dword [esi + 0x60847fb5]
pushal
pushal
fcmovnb st(0), st(6)
invalid
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x403e59
pop dword [ebp - 8]
mov eax, 0xc5665721
sub eax, 0xc52618c8
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xf9600a88
sub dword [ebp - 0x18], 0xab0dc53d
mov dword [ebp - 0x14], 0x73e16bbf
sub dword [ebp - 0x14], 0x41ae1f7a
mov dword [ebp - 0x10], 0x95e02d6e
add dword [ebp - 0x10], 0xb66c16c0
mov dword [ebp - 0xc], 0x85a7b347
add dword [ebp - 0xc], 0x7a584cb9
lea eax, [ebp - 0x18]
push eax
mov eax, 0xa1db5956
add eax, 0x5e652736
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x4c0f8354
add dword [ebp - 0x18], 0x2862e602
mov dword [ebp - 0x14], 0xf749ee50
sub dword [ebp - 0x14], 0xb5dd8cdb
mov dword [ebp - 0x10], 0xc17f440f
add dword [ebp - 0x10], 0xa1f0285d
mov dword [ebp - 0xc], 0x282d7a42
sub dword [ebp - 0xc], 0x282d7a42
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x68ef46a3
add eax, 0x97513a31
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x382bd
push 0
call eax
mov ecx, 0x39421e1e
sub ecx, 0x3941d06c
mov edi, eax
mov ebx, 0x411000
add ebx, dword [ebp - 8]
mov edx, 0xabf16818
sub edx, 0x373d4d91
xor dword [ebp - 4], 0x4308355f
mov esi, dword [ebx]
mov dword [ebp - 4], 0x501cc402
add esi, edx
xor dword [ebp - 4], ecx
mov dword [edi], esi
sub dword [ebp - 4], ebx
add edi, 0xbb6b5a6b
sub edi, 0xbb6b5a67
add ebx, 4
loop 0x403f75
add eax, 0xcbda881c
add eax, 0x3426a17f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x51a780
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x117000]
push edi
or ebp, 0xffffffff
jmp 0x51a7a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51a7a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a798
mov eax, 1
add ebx, ebx
jne 0x51a7bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51a7cc
jne 0x51a7eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a7eb
dec eax
add ebx, ebx
jne 0x51a7d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51a7b0
add ebx, ebx
jne 0x51a7e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51a83d
xor ecx, ecx
sub eax, 3
jb 0x51a803
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51a872
sar eax, 1
mov ebp, eax
jmp 0x51a80e
add ebx, ebx
jne 0x51a80e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a7dc
inc ecx
add ebx, ebx
jne 0x51a81c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a7dc
add ebx, ebx
jne 0x51a829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51a81e
jne 0x51a83a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51a81e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51a85c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51a84e
jmp 0x51a79e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51a85c
add edi, ecx
jmp 0x51a79e
pop esi
lea edi, [esi + 0x118000]
mov eax, dword [edi]
or eax, eax
je 0x51a8bb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e8cb0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e8d14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51a879
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e8d1c]
or eax, eax
je 0x51a8b5
mov dword [ebx], eax
add ebx, 4
jmp 0x51a896
call dword [esi + 0x1e8d18]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x51a8ec
cmp al, 0xef
ja 0x51a8df
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x51a8c1
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x51a8ce
mov ebp, dword [esi + 0x1e8d20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51a920
sub esp, 0xffffff80
jmp 0x411140
Function at 0x405829
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x405878
mov dword [ebp - 4], 0
jmp 0x405850
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xa
jge 0x405873
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405871
jmp 0x405873
jmp 0x405847
jmp 0x40595e
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x405897
jmp 0x40595e
lea edx, [ebp - 0x660]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov word [ebp - 0x630], 0
mov eax, dword [ebp - 0x634]
or al, 0x81
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x654], str.Cleanup...
push 0x104
lea ecx, [ebp - 0x61c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.004096d0
add esp, 8
push str._CLEANUP
lea eax, [ebp - 0x414]
push eax
call fcn.004096e0
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.004096e0
add esp, 8
push 0x415130
lea eax, [ebp - 0x660]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x518]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x405962
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [str.ARM.TMP]
mov dword [ebp - 0x31c], eax
mov ecx, dword [0x412364]
mov dword [ebp - 0x318], ecx
mov dl, byte [0x412368]
mov byte [ebp - 0x314], dl
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x310]
push ecx
call fcn.00409890
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4059c5
mov edx, dword [ebp - 4]
mov byte [edx + 1], 0
jmp 0x4059d9
push 0x415594
lea eax, [ebp - 0x310]
push eax
call fcn.004096d0
add esp, 8
push 0x104
lea ecx, [ebp - 0x424]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x424]
push edx
call fcn.00409890
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a5e
mov eax, dword [ebp - 4]
add eax, 1
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.004096d0
add esp, 8
push 0x2e
lea edx, [ebp - 0x108]
push edx
call fcn.00409890
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405a4b
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004097d0
add esp, 8
mov dword [ebp - 4], eax
push str..TMP
mov ecx, dword [ebp - 4]
push ecx
call fcn.004096d0
add esp, 8
jmp 0x405a72
push 0x415598
lea edx, [ebp - 0x108]
push edx
call fcn.004096d0
add esp, 8
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x320], 1
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x405ae4
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x310]
push eax
call fcn.00405b1a
add esp, 8
and eax, 0xff
test eax, eax
jne 0x405abe
mov byte [ebp - 0x320], 0
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00405b1a
add esp, 8
and eax, 0xff
test eax, eax
jne 0x405ae4
mov byte [ebp - 0x320], 0
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.00405b1a
add esp, 8
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00405b1a
add esp, 8
mov al, byte [ebp - 0x320]
mov esp, ebp
pop ebp
ret
Function at 0x405b1a
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov byte [ebp - 0x250], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.004096d0
add esp, 8
push 0
lea edx, [ebp - 0x248]
push edx
call fcn.004097d0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004096d0
add esp, 8
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x405b8c
mov al, byte [ebp - 0x250]
jmp 0x405bef
mov ecx, 1
test ecx, ecx
je 0x405bdc
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004096d0
add esp, 8
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405bc0
mov byte [ebp - 0x250], 0
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405bda
jmp 0x405bdc
jmp 0x405b8c
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x250]
mov esp, ebp
pop ebp
ret

Function at 0x405bf3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
and eax, 0xff
test eax, eax
je 0x405c14
push 0xffffffffffffffff
mov ecx, dword [0x415130]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 8]
push edx
mov eax, dword [0x415130]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x415134]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x415130]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040507c
call dword [0x415254]
mov eax, dword [0x415368]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x415470]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x415248]
mov eax, dword [edx]
sub eax, 1
mov ecx, dword [0x415248]
mov dword [ecx], eax
mov edx, dword [0x415248]
xor eax, eax
cmp dword [edx], 0
sete al
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
test ecx, ecx
je 0x405cbd
xor edx, edx
mov dl, byte [0x41524c]
test edx, edx
jne 0x405cbd
push 0x415140
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405cbd
push 0
push 0x415140
call fcn.00405829
add esp, 8
xor eax, eax
mov al, byte [0x41524c]
neg eax
sbb al, al
not al
and eax, dword [ebp - 4]
push eax
call fcn.00405962
add esp, 4
mov ecx, dword [0x415248]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [0x415128]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x405cf7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push str.ArmAccess
mov eax, dword [0x415368]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x405d2a
mov eax, 1
jmp 0x405dc6
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push 0x412380
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str..mailslotclient_
lea edx, [ebp - 0x100]
push edx
call fcn.004096d0
add esp, 8
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.004096e0
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x415474], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x415474]
push edx
mov eax, dword [0x415470]
push eax
call dword [ebp - 0x208]
add esp, 0x10
mov dword [ebp - 0x204], eax
mov ecx, dword [0x415474]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x204]
mov esp, ebp
pop ebp
ret
Function at 0x406a84
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406ab9
mov dword [0x415484], 1
xor al, al
jmp 0x406b76
mov eax, dword [ebp - 8]
and eax, 0x80000000
test eax, eax
je 0x406ad5
mov ecx, dword [ebp - 8]
and ecx, 0x7fffffff
mov dword [ebp - 8], ecx
mov byte [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x406b6c
cmp dword [ebp + 0xc], 0
je 0x406b5a
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406b0f
mov dword [0x415484], 1
xor al, al
jmp 0x406b76
cmp dword [ebp + 0x14], 0
je 0x406b29
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.00403edb
add esp, 0xc
mov eax, dword [ebp - 0xc]
and eax, 0xff
test eax, eax
jne 0x406b58
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00404099
add esp, 0xc
and eax, 0xff
test eax, eax
jne 0x406b58
xor al, al
jmp 0x406b76
jmp 0x406b6c
push 1
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x406d7a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [0x41535c], 1
lea eax, [ebp - 4]
push eax
push 0
push 0x415130
push 0x4050d8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x415364], eax
xor ecx, ecx
mov cl, byte [0x41535c]
cmp ecx, 1
jne 0x406dbd
push 0
push 0x7d
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x406da4
mov esp, ebp
pop ebp
ret
Function at 0x40773a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x10000
call fcn.00408efd
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 1
mov ecx, dword [ebp - 8]
and ecx, 0xff
test ecx, ecx
je 0x4077d3
mov dword [ebp - 4], 0x10000
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406a84
add esp, 0x10
and eax, 0xff
test eax, eax
je 0x4077c3
cmp dword [ebp - 4], 0
jne 0x407797
jmp 0x4077d3
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4077c1
mov dword [0x415484], 2
mov byte [ebp - 8], 0
jmp 0x4077d1
mov dword [0x415484], 0
mov byte [ebp - 8], 0
jmp 0x40775a
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00408ef2
add esp, 4
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4077ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
lea eax, [ebp - 0x244]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x412554
lea ecx, [ebp - 0x244]
push ecx
call fcn.004096e0
add esp, 8
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jne 0x407842
xor al, al
jmp 0x407851
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x407855
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
jne 0x40789e
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x108]
push edx
call fcn.00409890
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40789e
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
test ecx, ecx
je 0x4078bd
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp + 8]
push eax
push 0
push 0x412558
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4078f4
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
jne 0x4078f4
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00407855
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x407d0a
Capabilities:
Create mailslot
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x415358]
push eax
push str._08X
lea ecx, [ebp - 0x200]
push ecx
call fcn.004098b7
add esp, 0xc
lea edx, [ebp - 0x200]
push edx
push str.ArmServerInfo
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str..mailslot_server_
lea eax, [ebp - 0x100]
push eax
call fcn.004096d0
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.004096e0
add esp, 8
push 0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [0x415470], eax
mov esp, ebp
pop ebp
ret

Function at 0x407d85
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push 1
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004078f8
add esp, 0xc
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
jne 0x407dc5
xor eax, eax
jmp 0x407f33
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x412170]
xor ecx, dword [0x412164]
xor ecx, dword [0x412178]
xor ecx, dword [0x412160]
cmp dword [ebp - 0x128], ecx
je 0x407df9
xor eax, eax
jmp 0x407f33
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
jne 0x407e2b
xor eax, eax
jmp 0x407f33
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 4]
push eax
push 0x40
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0x40
jne 0x407ec8
mov eax, dword [ebp - 0x284]
and eax, 0xffff
cmp eax, 0x5a4d
jne 0x407ec8
push 0
push 0
mov ecx, dword [ebp - 0x248]
push ecx
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 0xf8
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0xf8
jne 0x407ec8
cmp dword [ebp - 0x244], 0x4550
jne 0x407ec8
mov eax, dword [ebp - 0x21c]
add eax, dword [ebp - 0x210]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x412194]
xor edx, dword [0x412164]
xor edx, dword [0x41216c]
xor edx, dword [0x412180]
test edx, edx
je 0x407f13
mov eax, dword [0x412194]
xor eax, dword [0x412164]
xor eax, dword [0x41216c]
xor eax, dword [0x412180]
cmp dword [ebp - 8], eax
je 0x407f11
xor eax, eax
jmp 0x407f33
jmp 0x407f2e
mov ecx, dword [0x41215c]
xor ecx, dword [0x412174]
xor ecx, dword [0x412178]
cmp dword [ebp - 8], ecx
je 0x407f2e
xor eax, eax
jmp 0x407f33
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x407f37
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push edi
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov cl, byte [0x4155a4]
mov byte [ebp - 0x250], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x24f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x407f9d
cmp dword [ebp - 0x3c], 0
jne 0x407f9d
lea eax, [ebp - 0x250]
push eax
call fcn.00408061
add esp, 4
and eax, 0xff
test eax, eax
je 0x407f9d
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x3c], ecx
push 0x104
lea edx, [ebp - 0x14c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x14c]
push eax
push str.PROTECTEDFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x5c
lea ecx, [ebp - 0x14c]
push ecx
call fcn.00409890
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407fee
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x407ff7
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x14c]
push edx
push str.PROTECTEDFILEPATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x415130
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40805a
mov dword [0x415484], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_code__d_
push 0x415488
call fcn.004098b7
add esp, 0xc
xor al, al
jmp 0x40805c
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret