joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43aca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43acc0
cmp edi, 0xfffffff5
jge 0x43acd7
mov eax, 0xffffffff
jmp 0x43acda
lea eax, [edi + 0xa]
push eax
call fcn.00409390
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43ad21
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43ad10
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 4], ax
add edi, 0xa
mov word [esp + 6], di
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xb2b5b4b7
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43ade5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43ada0
mov edi, dword [esp + 0x10]
mov eax, dword [0x4491d8]
test eax, eax
je 0x43ae41
xor ecx, ecx
mov edx, dword [0x4491dc]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x366ceda
je 0x43ae10
inc ecx
cmp eax, ecx
jne 0x43ae00
jmp 0x43ae41
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43ae41
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x4491e0]
push eax
call fcn.00438180
add esp, 0x24
mov edi, eax
push esi
call fcn.004093a0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ae60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43ae80
cmp edi, 0xfffffff5
jge 0x43ae97
mov eax, 0xffffffff
jmp 0x43ae9a
lea eax, [edi + 0xa]
push eax
call fcn.00409390
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43aee1
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43aed0
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 4], ax
add edi, 0xa
mov word [esp + 6], di
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xb2b5b4b7
mov dword [esp + 0x2c], 0
mov byte [esp + 0x30], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43afa5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43af60
mov edi, dword [esp + 0x28]
mov eax, dword [0x4491d8]
test eax, eax
je 0x43aff5
xor ecx, ecx
mov edx, dword [0x4491dc]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb5b385c7
je 0x43afd0
inc ecx
cmp eax, ecx
jne 0x43afc0
jmp 0x43aff5
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43aff5
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x4491e0]
push eax
call fcn.00438180
add esp, 0x14
mov edi, eax
push esi
call fcn.004093a0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43b00b
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x43b0aa
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add al, 0xf1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x43b060
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x4491d8]
test edx, edx
je 0x43b108
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x4491dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3bebd150
je 0x43b0e0
inc edi
cmp edx, edi
jne 0x43b0d0
jmp 0x43b108
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43b108
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x4491e0]
push edx
call fcn.00438180
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43b115
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x43b121
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43b1a5
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43b160
mov eax, dword [esp + 8]
mov edi, dword [0x4491d8]
test edi, edi
je 0x43b20d
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x4491dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0xb0852ef6
je 0x43b1e0
inc ebx
cmp edi, ebx
jne 0x43b1d0
jmp 0x43b20d
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43b20d
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x4491e0]
push edi
call fcn.00438180
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43b2e8
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x43b298
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xf1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x43b250
mov eax, dword [esp + 8]
mov ecx, dword [0x4491d8]
test ecx, ecx
je 0x43b2e0
xor edx, edx
mov esi, dword [0x4491dc]
nop
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x43b2c0
inc edx
cmp ecx, edx
jne 0x43b2b0
jmp 0x43b2e0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b2e0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x4491e0]
push ecx
call fcn.00438180
add esp, 0x18
test eax, eax
js 0x43b2e8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x43b2fb
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43b2f9
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43b385
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43b340
mov eax, dword [esp + 8]
mov edi, dword [0x4491d8]
test edi, edi
je 0x43b3ed
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x4491dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x58c2bab5
je 0x43b3c0
inc ebx
cmp edi, ebx
jne 0x43b3b0
jmp 0x43b3ed
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43b3ed
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x4491e0]
push edi
call fcn.00438180
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43b4c8
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x43b478
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xf1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x43b430
mov eax, dword [esp + 8]
mov ecx, dword [0x4491d8]
test ecx, ecx
je 0x43b4c0
xor edx, edx
mov esi, dword [0x4491dc]
nop
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x43b4a0
inc edx
cmp ecx, edx
jne 0x43b490
jmp 0x43b4c0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b4c0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x4491e0]
push ecx
call fcn.00438180
add esp, 0x18
test eax, eax
js 0x43b4c8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x43b4d2
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43b500
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
xor edx, 2
imul edx, ecx
lea ecx, [edx + ebx]
mov word [esp + 4], cx
lea ecx, [edx + ebx]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xb2b5b4b7
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43b5d5
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43b590
mov eax, dword [esp + 0x10]
mov edi, dword [0x4491d8]
test edi, edi
je 0x43b625
xor ebx, ebx
mov ecx, dword [0x4491dc]
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x850a6e6
je 0x43b600
inc ebx
cmp edi, ebx
jne 0x43b5f0
jmp 0x43b625
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, eax
je 0x43b625
lea eax, [esp + 0x24]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 4
push dword [0x4491e0]
push ecx
call fcn.00438180
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a397
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x419004]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov esi, dword [ebp + 8]
push 0x406f00
push 0x406f1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a3d1
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409496
push esi
lea ecx, [esp + 0x24]
call fcn.00408b70
lea ecx, [esp + 0x20]
call fcn.00408e9c
mov esi, eax
test esi, esi
jns 0x40a44f
lea ecx, [esp + 8]
call fcn.0040a30c
test al, al
je 0x40a499
cmp esi, 0x80040b00
jne 0x40a499
and dword [esp + 0x4c], 0
lea ecx, [esp + 0x20]
xor eax, eax
mov dword [esp + 0x50], 7
mov word [esp + 0x3c], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00408f41
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.004095f1
test esi, esi
js 0x40a499
mov esi, 0x80040b02
jmp 0x40a499
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40a45e
mov esi, dword [esp + 8]
push 0x406d74
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40a491
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40a48a
jle 0x40a499
movzx esi, si
or esi, 0x80070000
jmp 0x40a499
mov esi, 0x80004005
jmp 0x40a499
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
cmp dword [esp + 0x20], 0
je 0x40a4aa
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x24]
call fcn.004095f1
lea ecx, [esp + 8]
call fcn.004095f1
mov ecx, dword [esp + 0x54]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ab91
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402000
Capabilities:
Terminate process

Disassembly:
call fcn.00402089
push 0
push 2
push 0x404059
push 0x404044
call dword [0x4060ec]
cmp eax, 0x122
jne 0x402054
mov word [0x40406f], ax
call fcn.00403460
push edx
mov eax, eax
push 0
push 2
push 0x404059
push 0x40405b
call dword [0x4060ec]
pop edx
add edx, eax
xor ebx, ebx
mov bx, word [0x40406f]
add edx, ebx
call edx
xor eax, eax
add esp, 0x18
pop edi
pop esi
pop ebx
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x402089
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
push 0x40407d
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
sub esp, 0xe
mov byte [esp], 0x6d
mov byte [esp + 1], 0x63
mov byte [esp + 2], 0x69
mov byte [esp + 3], 0x53
mov byte [esp + 4], 0x65
mov byte [esp + 5], 0x6e
mov byte [esp + 6], 0x64
mov byte [esp + 7], 0x53
mov byte [esp + 8], 0x74
mov byte [esp + 9], 0x72
mov byte [esp + 0xa], 0x69
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x67
mov byte [esp + 0xd], 0x41
mov byte [esp + 0xe], 0
lea eax, [esp]
push eax
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x4060ec], eax
leave
ret

Function at 0x40349b
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push 0x40
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
ret
Function at 0x402a4c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ae0
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a9d
cmp dword [ebp + 0x10], ebx
jne 0x402ad4
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a4c
test eax, eax
jne 0x402aaf
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a84
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.00405efe
cmp eax, ebx
je 0x402ae7
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ae0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402add
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402add
jmp 0x402ae0
Function at 0x402e71
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e8e
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402e9d
mov ebx, 0x40f100
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402eb2
mov ecx, dword [0x423fb8]
add ecx, eax
push ecx
call fcn.00403096
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403064
test eax, eax
je 0x40300f
test byte [ebp + 0x17], 0x80
je 0x402ff8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40b070
mov dword [ebp - 0xc], eax
call fcn.00405fdb
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40305a
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f02
mov esi, dword [ebp + 0x14]
mov edi, 0x40b100
push esi
push edi
call fcn.00403064
test eax, eax
je 0x40300f
sub dword [ebp + 0x14], esi
mov dword [0x40b088], edi
mov dword [0x40b08c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40b070
mov dword [0x40b090], ebx
mov dword [0x40b094], eax
call fcn.00405ffb
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x402ff0
mov esi, dword [0x40b090]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x424014], 1
mov edi, eax
je 0x402fa4
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f71
cmp dword [ebp + 0x14], 0
jne 0x402fa4
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404e5e
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402fe5
cmp dword [ebp + 0x10], eax
jne 0x402fcd
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402ff4
cmp dword [ebp - 0x10], esi
jne 0x402ff4
add dword [ebp - 4], esi
jmp 0x402fd9
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x40b090]
cmp dword [ebp - 0x14], 1
jne 0x402f25
jmp 0x40305a
cmp dword [ebp + 0x14], eax
jg 0x402ef5
jmp 0x40305a
push 0xfffffffffffffffc
jmp 0x403011
push 0xfffffffffffffffe
jmp 0x403011
test edi, edi
je 0x40304f
cmp dword [ebp + 0x14], esi
jge 0x403004
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403064
test eax, eax
jne 0x403057
push 0xfffffffffffffffd
pop eax
jmp 0x40305d
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x40301f
mov esi, dword [ebp + 0x14]
mov edi, 0x40b100
push esi
push edi
call fcn.00403064
test eax, eax
je 0x40300f
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402ff4
cmp esi, dword [ebp + 0x10]
jne 0x402ff4
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403014
jmp 0x40305a
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405320
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x407310
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x407300
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x405371
xor eax, eax
jmp 0x405398
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405398
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
jne 0x40536d
call esi
pop esi
leave
ret 4

Function at 0x4053d2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422560], 0x44
push eax
xor eax, eax
push 0x422560
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40540d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4