Function at 0x403340
Capabilities:
Create thread
Get file attributes
Get memory capacity
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3a8
call fcn.00401ca0
xor ecx, ecx
mov r9d, 0x41
mov rdx, qword [str.DISCLAIMER:_This_program_is_intended_solely_for_educational_purposes_as_part_of_a_malware_analysis_exercise_with_the_University_of_Arizona_CYBV_454_Malware_Analysis_class_with_Professor_Galde._This_program_is_not_intended_to_be_used_for_any_malicious_or_harmful_activities._If_you_have_found_this_on_your_machine_please_email_michaelgalde_arizona.edu_The_use_of_packers_and_obfuscation_techniques_demonstrated_in_this_program_should_never_be_applied_to_create_real_world_malware._By_analyzing_this_program__you_acknowledge_and_agree_to_use_it_only_within_a_controlled_learning_environment_and_not_to_distribute_or_use_it_maliciously._Please_hit_cancel_to_exit_this_program_if_you_do_not_wish_to_continue.]
lea r8, str.Educational_Malware_Analysis_Exercise
mov rsi, qword [sym.imp.USER32.dll_MessageBoxA]
call rsi
cmp eax, 1
mov ebx, eax
je 0x40338e
xor ebx, ebx
mov eax, ebx
add rsp, 0x3a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea r8, [rsp + 0xe4]
xor ebp, ebp
mov ecx, 0x24
mov dword [rsp + 0xe0], 0x94
lea rdx, [rsp + 0xe0]
mov rdi, r8
mov eax, ebp
rep stosd dword [rdi], eax
mov rcx, rdx
call qword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [rsp + 0xe4], 4
jbe 0x4035e8
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x40]
shr rax, 0x1e
sub eax, 1
jle 0x4035cb
mov eax, ebp
mov ecx, 0x3f
mov qword [rsp + 0x290], 0
mov r8d, 0x104
lea rdi, [rsp + 0x298]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x180]
lea rcx, str.USERPROFILE
mov rdx, rdi
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea rbx, [rsp + 0x290]
test eax, eax
jne 0x403605
mov rcx, rbx
call fcn.00401710
xor ecx, ecx
mov r9d, 0x24
lea r8, str.Confirmation
lea rdx, str.Are_you_ready_to_take_the_final_
call rsi
cmp eax, 7
je 0x40337a
lea r8, str.Information
mov r9d, 0x40
xor ecx, ecx
lea rdx, str.Get_Ready__Its_time_to_use_your_skills_to_figure_this_program_out.
call rsi
lea rcx, str.QXJpem9uYS1XaWxkY2F0MjAyNA
call fcn.00401ab0
lea rcx, str.Lets_start_by_looking_for_a_Decoded_secret._This_might_help_you_find_it__maybe__Address:__p_n
lea rsi, [rsp + 0x70]
mov rdx, rax
mov rdi, rax
call sub.msvcrt.dll_printf
lea rcx, str.Enter_the_decoded_secret:
call sub.msvcrt.dll_printf
xor ecx, ecx
call qword [fcn.004031b0]
mov edx, 0x64
mov rcx, rsi
mov r8, rax
call sub.msvcrt.dll_fgets
lea rdx, [0x004054e1]
mov rcx, rsi
call sub.msvcrt.dll_strcspn
lea rdx, str.Arizona_Wildcat2024
mov rcx, rsi
mov byte [rsp + rax + 0x70], 0
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x40365c
add dword [0x00408040], 1
lea rcx, str.Congratulations__You_found_the_decoded_secret.
mov dword [0x00408030], 1
call sub.msvcrt.dll_puts
mov rsi, qword [sym.imp.KERNEL32.DLL_CreateThread]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
lea r8, [0x00401930]
mov dword [rsp + 0x20], 0
call rsi
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r13, rax
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea r8, [0x004015d0]
call rsi
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8, [0x00401550]
mov r12, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rsi
mov rsi, qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
or edx, 0xffffffff
mov rcx, r13
mov rbp, rax
call rsi
or edx, 0xffffffff
mov rcx, r12
call rsi
or edx, 0xffffffff
mov rcx, rbp
call rsi
mov rsi, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, r13
call rsi
mov rcx, r12
call rsi
mov rcx, rbp
call rsi
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rbx
call fcn.00401710
jmp 0x40337a
lea r8, str.Error
mov r9d, 0x10
xor ecx, ecx
lea rdx, str.You_should_never_see_this_but_somehow_you_are_running_Windows_on_a_device_with_less_than_2GB_available._In_2024__that_is_crazy_
call rsi
jmp 0x40337c
lea r8, str.Error
mov r9d, 0x10
xor ecx, ecx
lea rdx, str.The_version_of_Windows_you_are_using_is_too_old._Please_contact_your_Professor_to_get_a_new_version_of_Windows.
call rsi
jmp 0x40337c
mov r9, rdi
mov edx, 0x104
mov rcx, rbx
lea r8, str._sCYBV454_Homework.txt
call fcn.004015b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
add eax, 1
je 0x40343e
lea r8, str.Secret_Found
mov r9d, 0x40
xor ecx, ecx
lea rdx, str.Good_job__you_found_a_secret___The_secret_is__Banana_Cherry_.
call rsi
mov dword [0x0040803c], 1
add dword [0x00408040], 1
jmp 0x40343e
lea rcx, str.Sorry__thats_not_the_correct_decoded_secret._Keep_trying_
call sub.msvcrt.dll_puts
jmp 0x40350e