joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410038
Capabilities:
Read file on windows

Disassembly:
push 0x4c
mov eax, 0x416a8f
call fcn.00415adb
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0041085c
mov dword [ebp - 0x50], eax
test eax, eax
je 0x41011c
xor ebx, ebx
lea eax, [ebp - 0x50]
inc ebx
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], bl
and dword [ebp - 4], 0
lea edx, [ebp - 0x4c]
mov ecx, edi
call fcn.004108ca
test eax, eax
jne 0x41010b
mov eax, dword [ebp - 0x34]
mov dword [esi + 4], eax
test eax, eax
je 0x4100ef
push ecx
lea edi, [esi + 0xc]
mov byte [ebp - 4], bl
push eax
mov ecx, edi
call fcn.004049e6
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x4100a2
mov edi, dword [edi]
push dword [ebp - 0x50]
push dword [esi + 4]
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x4100f2
cmp eax, dword [esi + 4]
jne 0x4100f2
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x4100c7
mov eax, dword [eax]
mov dword [esi], eax
mov dword [ebp - 4], 4
jmp 0x4100e1
push dword [ebp - 0x50]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov al, bl
jmp 0x41011e
mov byte [esi + 8], bl
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x4100ff
mov ecx, dword [eax]
xor edx, edx
mov dword [eax + 0x10], edx
mov byte [ecx], dl
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [ebp - 4], 5
push dword [ebp - 0x50]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
xor al, al
call fcn.00415a28
ret 4

Function at 0x410126
Capabilities:
Get system information on windows

Disassembly:
push 0x24
mov eax, 0x416ab6
call fcn.00415a39
mov ebx, ecx
mov byte [ebx], 0
lea eax, [ebx + 4]
and dword [ebp - 4], 0
push 2
push eax
call dword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
pop ecx
xor eax, eax
fldz
pop ecx
push 9
pop ecx
mov dword [ebx + 0x48], eax
lea edi, [ebp - 0x30]
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
fstp qword [ebx + 0x58]
push eax
mov dword [ebx + 0x40], 0xfa00
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebx + 0x40]
xor edx, edx
add esi, 7
add esi, dword [ebp - 0x2c]
mov eax, esi
div dword [ebp - 0x2c]
mov eax, ebx
sub esi, edx
sub esi, 0xc
mov dword [ebx + 0x40], esi
call fcn.00415a02
ret 8

Function at 0x410722
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x21c
mov eax, 0x416b49
call fcn.00415a6d
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x228]
mov dword [ebp - 4], ebx
call fcn.00410fd0
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41077d
mov ecx, eax
call fcn.00410ffc
test al, al
jne 0x41077d
mov bl, 1
lea ecx, [ebp - 0x14]
call fcn.00410a87
mov al, bl
call fcn.00415a17
ret
Function at 0x41078d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x220
mov eax, 0x416b83
call fcn.00415a6d
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x228]
mov dword [ebp - 4], ebx
call fcn.00410fd0
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4107ff
push dword [ebp - 0x22c]
push eax
call fcn.00411022
push dword [ebp - 0x22c]
mov ecx, eax
push 0x10
call fcn.00411022
add esp, 0x10
test eax, ecx
je 0x4107ff
mov bl, 1
lea ecx, [ebp - 0x14]
call fcn.00410a87
mov al, bl
call fcn.00415a17
ret
Function at 0x41107c
Capabilities:
Enumerate files on windows

Disassembly:
push 0x5b4
mov eax, 0x416c35
call fcn.00415a6d
mov ebx, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
cmp byte [edi + 1], 0
jne 0x4112c9
xor eax, eax
xor esi, esi
mov word [ebp - 0x334], ax
lea eax, [ebp - 0x334]
mov dword [ebp - 0x338], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x33c], eax
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x33c]
push eax
mov dword [ebp - 4], esi
call fcn.00410f03
lea ecx, [ebp - 0x33c]
call fcn.00411593
push 2
push esi
push esi
lea eax, [ebp - 0x58c]
push eax
push 1
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0x590], eax
cmp eax, 0xffffffff
jne 0x41110a
mov byte [edi + 1], 1
jmp 0x4112be
lea eax, [ebp - 0x590]
mov byte [ebp - 0x5b4], 1
mov dword [ebp - 0x5b8], eax
xor edx, edx
mov dword [ebp - 0x5b0], edx
mov dword [ebp - 0x5ac], edx
mov dword [ebp - 0x5a8], edx
mov dword [ebp - 0x5a4], edx
mov dword [ebp - 0x5a0], edx
mov dword [ebp - 0x59c], edx
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x11c], dl
mov dword [ebp - 0x124], eax
mov byte [ebp - 4], 4
lea esi, [ebp - 0x560]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x41116b
sub esi, ecx
sub esp, 0xc
sar esi, 1
lea ecx, [ebp - 0x560]
mov edx, esi
call fcn.0041102a
add esp, 0xc
test al, al
jne 0x411257
lea ecx, [ebp - 0x560]
call fcn.004106c9
lea eax, [ebp - 0x124]
mov edx, esi
push eax
lea ecx, [ebp - 0x560]
call fcn.00410f42
mov eax, dword [ebx + 0x18]
pop ecx
cmp eax, dword [ebx + 0x1c]
je 0x41120a
mov esi, dword [ebp - 0x120]
mov edx, esi
push 0x2e
push ecx
mov ecx, dword [ebp - 0x124]
call fcn.004067c9
add esp, 8
cmp eax, 0xffffffff
je 0x411216
inc ecx
add eax, ecx
lea ecx, [ebp - 0x5c0]
push eax
call fcn.0040aa8e
mov esi, dword [ebx + 0x18]
jmp 0x411203
lea edx, [ebp - 0x5c0]
mov ecx, esi
call fcn.004067f4
test al, al
jne 0x41120a
add esi, 8
cmp esi, dword [ebx + 0x1c]
jne 0x4111ef
jmp 0x411257
mov esi, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x124]
push esi
push ecx
lea ecx, [ebx + 0x60]
call fcn.00404c59
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x594], esi
test eax, eax
je 0x411257
mov ecx, dword [ebp - 0x58c]
call fcn.00410ffc
test al, al
lea ecx, [ebp - 0x5a4]
lea eax, [ebp - 0x598]
push eax
jne 0x411252
lea ecx, [ebp - 0x5b0]
call fcn.00411566
lea eax, [ebp - 0x58c]
push eax
push dword [ebp - 0x590]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
pop edx
test eax, eax
jne 0x411162
lea eax, [ebp - 0x5b0]
mov ecx, edi
push eax
call fcn.00411359
lea eax, [ebp - 0x5a4]
mov ecx, edi
push eax
call fcn.00411441
lea ecx, [ebp - 0x14]
mov byte [edi], 1
call fcn.00405f5a
lea ecx, [ebp - 0x5a4]
call fcn.004065ec
lea ecx, [ebp - 0x5b0]
call fcn.004065ec
push dword [ebp - 0x590]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x128]
call fcn.00410a87
call fcn.00415a17
ret 0xc
Function at 0x412f14
Capabilities:
Read file on windows

Disassembly:
push 0x10
mov eax, 0x416ce3
call fcn.00415a39
and dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0xffff
call fcn.0041085c
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x412f3c
mov eax, dword [ebp - 0x10]
jmp 0x412f7a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x10], 1
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
push eax
push 4
lea eax, [ebp - 0x18]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00412e16
mov esi, eax
mov dword [ebp - 4], 1
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
mov eax, esi
call fcn.00415a02
ret
Function at 0x413b73
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push dword [ecx + 0xc]
shr eax, 1
add ebx, eax
mov dword [ebp - 4], ecx
add eax, 0xfffffffe
push eax
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov esi, eax
cmp byte [ebp + 8], 0
mov dword [ebp - 8], esi
je 0x413bc1
xor edx, edx
test esi, esi
je 0x413bc1
mov al, byte [edx + ebx + 1]
mov cl, byte [edx + ebx]
mov byte [edx + ebx], al
mov byte [edx + ebx + 1], cl
add edx, 2
cmp edx, esi
jb 0x413bac
lea edi, [esi + ebx]
movzx eax, word [edi - 2]
cmp eax, 0xd
jne 0x413c21
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push edi
push dword [eax + 0xc]
call fcn.00413b1c
test al, al
je 0x413c4b
add esi, 2
cmp word [edi], 0xa
je 0x413c4b
cmp byte [ebp + 8], 0
je 0x413bf9
mov cl, byte [edi]
mov al, byte [edi + 1]
mov byte [edi], al
mov byte [edi + 1], cl
mov edi, dword [ebp - 4]
movsx eax, byte [ebx + esi - 1]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ungetc_nolock]
push dword [edi + 0xc]
push eax
call esi
push dword [edi + 0xc]
mov edi, dword [ebp - 8]
movsx eax, byte [edi + ebx]
push eax
call esi
add esp, 0x10
mov esi, edi
jmp 0x413c4b
mov ecx, 0xd800
cmp ax, cx
jb 0x413c4b
mov ecx, 0xdbff
cmp ax, cx
ja 0x413c4b
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push edi
push dword [eax + 0xc]
call fcn.00413b1c
test al, al
je 0x413c4b
add esi, 2
push dword [ebp + 0x14]
mov eax, esi
lea edx, [ebp + 8]
push dword [ebp + 0x10]
shr eax, 1
mov ecx, ebx
mov dword [ebp + 8], eax
call fcn.00411669
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x432005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x41110b]
shl eax, 2
mov dword [0x41110f], eax
push edi
push ecx
xor eax, eax
mov edi, 0x414e3c
mov ecx, 0x418638
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00405c87
pop ecx
push 0x4110d4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x411113], eax
push 0
jmp fcn.0040fce4
Function at 0x4051d7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
lea esi, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x148]
test ebx, ebx
jne 0x4051fd
or eax, 0xffffffff
jmp 0x405326
cmp dword [ebx], 0xffffffff
jne 0x405218
push esi
push dword [ebx + 0xc]
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
setne al
and eax, 1
jmp 0x405220
push esi
push dword [ebx]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x40522c
or eax, 0xffffffff
jmp 0x405326
cmp dword [ebx + 4], 0
je 0x405249
mov edx, dword [esi]
and edx, dword [ebx + 4]
jne 0x405251
test byte [ebx + 9], 0x10
jne 0x4051fd
test dword [esi], 0x1056
je 0x405251
jmp 0x4051fd
test dword [esi], 0x1056
jne 0x4051fd
cmp byte [ebx + 0x10], 0
je 0x40526b
lea ecx, [esi + 0x2c]
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.00405115
add esp, 8
test eax, eax
je 0x4051fd
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [edx + 0x128], ecx
lea eax, [ebp - 8]
push eax
lea edx, [esi + 0x14]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
mov ecx, dword [ebp + 8]
add ecx, 0x12c
push ecx
mov eax, dword [ebp + 8]
add eax, 0x12e
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToDosDateTime
test byte [ebx + 8], 2
je 0x4052e4
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
mov dword [ecx + 0x130], eax
mov eax, dword [esi + 8]
mov dword [ecx + 0x134], eax
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x138], ecx
mov ecx, dword [esi + 0x18]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0xc]
mov dword [eax + 0x140], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x144], edx
test byte [ebx + 8], 4
je 0x405304
push 0x1f
lea ecx, [esi + 0x130]
push ecx
mov eax, dword [ebp + 8]
add eax, 0x104
push eax
call fcn.00405868
add esp, 0xc
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
mov dword [edx + 0x124], ecx
push 0xff
lea eax, [esi + 0x2c]
push eax
push dword [ebp + 8]
call fcn.00405868
add esp, 0xc
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a4dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x40a50b
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x40a515
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x40a520
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x40a586
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x40a586
call fcn.0040aa20
jmp 0x40a5c1
push edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x40a596
call fcn.0040aa20
jmp 0x40a5c1
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x40a5bc
push edi
call sub.KERNEL32.dll_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x40a5ba
cmp ebx, 1
je 0x40a5ba
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x40a5a7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ac68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0040a5f4
test byte [ebp + 0xd], 0xc0
jne 0x40ac8c
mov eax, dword [0x413bb0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x40ac99
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40acc6
je 0x40acd8
sub ecx, 0x100
je 0x40ace6
sub ecx, 0x100
je 0x40aced
sub ecx, 0x100
je 0x40acdf
jmp 0x40acf4
sub ecx, 0x600
je 0x40aced
sub ecx, 0x100
je 0x40acd8
jmp 0x40acf4
mov edi, 1
jmp 0x40acf9
mov edi, 2
jmp 0x40acf9
mov edi, 4
jmp 0x40acf9
mov edi, 5
jmp 0x40acf9
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40ad20
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x41410c]
test al, 0x80
je 0x40ad19
mov ebx, 0x80
jmp 0x40ad32
mov ebx, 1
jmp 0x40ad32
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40ad32
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40ad44
je 0x40ad4d
dec eax
je 0x40ad56
jmp 0x40ad5f
mov dword [ebp - 4], 0x80000000
jmp 0x40ad6e
mov dword [ebp - 4], 0x40000000
jmp 0x40ad6e
mov dword [ebp - 4], 0xc0000000
jmp 0x40ad6e
push 1
call fcn.0040a9b4
pop ecx
mov ebx, eax
jmp 0x40ae5a
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x40ad8a
sub eax, 0x10
je 0x40ad91
sub eax, 0x10
je 0x40ad9a
sub eax, 0x10
je 0x40ada3
jmp 0x40ada3
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40adaa
mov dword [ebp - 8], 1
jmp 0x40adaa
mov dword [ebp - 8], 2
jmp 0x40adaa
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40ae13
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40ae08
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x40ae08
add ebx, 0xffffffb2
push ebx
call fcn.0040a9b4
pop ecx
mov ebx, eax
jmp 0x40ae5a
mov edi, esi
push edi
call fcn.0040abcc
pop ecx
test eax, eax
je 0x40ae27
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40ae33
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0040a6f4
add esp, 8
mov ebx, eax
inc eax
jne 0x40ae5a
push 4
call fcn.0040a9b4
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.0040a628
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e8e4
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40efb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x414a2c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40f068
cmp byte [0x41110a], 0
je 0x40f022
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.0040ddf0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40f00b
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.0040ddf0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40f00b
lea ebx, [ebp - 0x54]
jmp 0x40f00c
inc ebx
call fcn.0040ef68
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x40f089
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x414a30
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00405680
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x414a33
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x40f089
cmp dword [0x414a2c], 0xffffffff
je 0x40f089
mov eax, dword [0x414a2c]
test eax, eax
je 0x40f089
cmp byte [eax], 0
je 0x40f089
push esi
push eax
call fcn.0040f118
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x401270
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
cmp dword [0x848528], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jne 0x4012a3
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov ecx, dword [0x429158]
mov edx, dword [0x42915c]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 0x2c], 0x9e3779b9
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], edx
call fcn.00401260
mov eax, dword [0x429160]
mov ecx, dword [0x429164]
add dword [ebp - 8], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov ecx, dword [0x848528]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401346
push 0
lea edx, [ebp - 0x438]
push edx
push 0
call ebx
push 0
lea eax, [ebp - 0x38]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov eax, dword [ebp - 4]
mov ecx, dword [0x848528]
add eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x401360
mov dword [0x847ac4], 0xedeb2e40
jmp 0x401372
cmp ecx, 0x3eb
jne 0x401372
mov dword [0x847474], 0
mov ecx, dword [ebp - 8]
add ecx, edi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
mov esi, edi
shr esi, cl
mov dword [0x847ac0], 0xf4ea3dee
add esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
cmp dword [0x848528], 0x9e6
jne 0x4013aa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
xor esi, dword [ebp - 4]
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov edx, dword [ebp - 0xc]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
nop
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
shr esi, cl
add esi, dword [ebp - 0x24]
cmp dword [0x848528], 0x121
jne 0x401410
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [ebp - 4]
xor eax, esi
mov dword [ebp - 4], eax
sub edi, eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 8], eax
sub dword [ebp - 0x1c], 1
jne 0x4012f0
cmp dword [0x848528], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x401454
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0xc]
pop edi
mov dword [esi + 4], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401470
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x848528]
mov ecx, dword [0x847478]
shr eax, 3
sub esp, 8
test eax, eax
jbe 0x401504
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x848528], 0x959
jne 0x4014ee
push 0
push 0
call esi
push str.rogajacasuyawegigonujutexebusageruguhumepipijonifizifocuvitisuxuzesubagixasoyabiy
push 0
push 0
call edi
push 0
push 0
push str.kihubatigu
push str.lejigowuxoyojagijaxujocihipubav
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov eax, dword [ebp - 4]
push eax
call fcn.00401270
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4014a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret