joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002c10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [0x1001f5f8], 0x1aa4
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1001f5f4], 0x82f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10002c6f
mov dword [0x1001f5f4], 0x716
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10002ce1
jmp 0x10002d32
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x10002cb7
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x10002cd0
jmp 0x10002d32
mov dword [0x1001f5f4], 0x1ebc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10002c51
jmp 0x10002d32
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x10002c6f
jmp 0x10002c85
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10002c9c
jmp 0x10002d32
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10002d32
mov dword [0x1001f5f4], 0x90f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10002d32
mov eax, 0x1f9
mov ecx, 1
mov dword [0x1001f5f8], 0x201d
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
je 0x10002d46
xor eax, eax
mov ecx, dword [0x1001f5f4]
add ecx, 0x544
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x1001f5f4], ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x40102d
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [section..data], eax
push 0x403107
call sub.comctl32.dll_InitCommonControlsEx
push 0xa
push 0
push 0
push dword [section..data]
call 0x40102d
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffe4
push dword [section..data]
pop dword [0x403036]
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40303a], eax
mov dword [0x40304e], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x40303e], eax
push 0x403022
call sub.user32.dll_RegisterClassExA
push 1
call sub.user32.dll_GetSystemMetrics
shr eax, 1
sub eax, 0xc8
push eax
push 0
call sub.user32.dll_GetSystemMetrics
shr eax, 1
sub eax, 0x64
pop ebx
push 0
push dword [section..data]
push 0
push 0
push 0x190
push 0xc8
push ebx
push eax
push 0x2cf0000
push str.EnumFonts
push str.MainWindowClass
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x403004], eax
push 1
push eax
call sub.user32.dll_ShowWindow
push dword [0x403004]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_PeekMessageA
or eax, eax
je 0x401112
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4011cf
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4010d2
cmp dword [0x4030c4], 0
jne 0x4010d2
push 0x2ee0
push 0x40
call sub.kernel32.dll_LocalAlloc
mov dword [0x40310f], eax
push dword [0x40310f]
call sub.kernel32.dll_LocalLock
mov dword [0x403113], eax
mov dword [0x403117], eax
push dword [0x403004]
call sub.user32.dll_GetDC
mov dword [0x403080], eax
mov byte [0x40309f], 0
mov byte [0x4030a4], 0
mov byte [0x4030a3], 0
push 0
push dword [0x403004]
push 0x40130a
push 0x403088
push dword [0x403080]
call sub.gdi32.dll_EnumFontFamiliesExA
mov esi, dword [0x403113]
mov ecx, dword [0x40311b]
push ecx
push esi
push esi
push 0
push 0x180
push dword [0x403052]
call sub.user32.dll_SendMessageA
pop esi
pop ecx
dec ecx
jcxz 0x4011af
add esi, 0x3c
jmp 0x40118f
push dword [0x403080]
push dword [0x403004]
call sub.user32.dll_ReleaseDC
mov dword [0x4030c4], 1
jmp 0x4010d2
mov eax, dword [ebp - 0x14]
leave
ret 0x10
Function at 0x4014c1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x14c]
push ebx
push eax
call fcn.0040b080
xor eax, eax
mov dword [ebp - 0x14c], esi
lea edi, [ebp - 0x15c]
add esp, 0xc
stosd dword es:[edi], eax
lea ecx, [ebp - 0x108]
dec ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [str.cmd__c]
mov dword [ebp - 0x108], eax
mov eax, dword [0x4225a0]
mov dword [ebp - 0x104], eax
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40151c
mov eax, dword [str.pause]
mov dword [ecx], eax
mov ax, word [0x4226ac]
mov word [ecx + 4], ax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x14c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40157f
push 0xffffffffffffffff
push dword [ebp - 0x15c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x15c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x158]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408dac
mov esp, ebp
pop ebp
ret
Function at 0x404f08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x404fa7
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.0041a680
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x404f5c
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x404f83
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x405062
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x404fd4
xor eax, eax
jmp 0x405025
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x404ff1
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00403d8c
jmp 0x405009
cmp eax, 2
jne 0x40500d
mov edx, dword [esi]
test edx, edx
jne 0x405000
xor eax, eax
jmp 0x40500a
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00404069
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.0041a680
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x40504d
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x405062
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x404f19
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413bac
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041386c

Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194
Function at 0x46abe0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x469015
lea edi, [esi - 0x68015]
push edi
or ebp, 0xffffffff
jmp 0x46ac02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46ac09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46abf8
mov eax, 1
add ebx, ebx
jne 0x46ac1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46ac10
jne 0x46ac2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46ac10
xor ecx, ecx
sub eax, 3
jb 0x46ac40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46acb2
mov ebp, eax
add ebx, ebx
jne 0x46ac4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x46ac58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46ac7c
inc ecx
add ebx, ebx
jne 0x46ac68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46ac5d
jne 0x46ac79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46ac5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46ac9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46ac8d
jmp 0x46abfe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46ac9c
add edi, ecx
jmp 0x46abfe
pop esi
mov edi, esi
mov ecx, 0xfd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46acba
cmp byte [edi], 1
jne 0x46acba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x46acbf
lea edi, [esi + 0x68000]
mov eax, dword [edi]
or eax, eax
je 0x46ad2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6a050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46acec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6a054]
or eax, eax
je 0x46ad28
mov dword [ebx], eax
add ebx, 4
jmp 0x46ad09
call dword [esi + 0x6a058]
popal
jmp 0x401220
Function at 0x401c50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401c9b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c94
test esi, esi
je 0x401c94
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c70
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e80
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401fa8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f0e
cmp eax, 4
jne 0x401f30
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f1e
cmp edx, 4
je 0x401f1e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e80

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401c66
pop dword [ebp - 0x3c]
mov eax, 0xa236aab5
add eax, 0x5e0971b1
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x17151abe
add dword [ebp - 0x4c], 0x373d2a8d
mov dword [ebp - 0x48], 0xdabd0839
sub dword [ebp - 0x48], 0xa889bbf4
mov dword [ebp - 0x44], 0x5bb05891
add dword [ebp - 0x44], 0xf09beb9d
mov dword [ebp - 0x40], 0xe83f0815
sub dword [ebp - 0x40], 0xe83f0815
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x13c999e2
add dword [ebp - 0x4c], 0x60a8cf74
mov dword [ebp - 0x48], 0x871a6c6d
add dword [ebp - 0x48], 0xba51f508
mov dword [ebp - 0x44], 0xfc1b5c5
sub dword [ebp - 0x44], 0xac524959
mov dword [ebp - 0x40], 0xb1321f07
add dword [ebp - 0x40], 0x4ecde0f9
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x86f04b2a
add eax, 0x794fe502
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3421a
push 0
call eax
mov ecx, 0xa15e3155
add ecx, 0x5ea20d45
mov edx, eax
mov esi, 0x628ff2e1
sub esi, 0x624f82e1
add esi, dword [ebp - 0x3c]
mov ebx, 0x2670172a
mov dword [ebp - 0x20], 0x4a8fa9c3
mov edi, dword [esi]
sub dword [ebp - 0x34], edx
xor edi, ebx
xor dword [ebp - 0x1c], ebx
mov dword [edx], edi
xor dword [ebp - 0x38], 0x91b39343
add edx, 0x49b219a1
add edx, 0xb64de663
add esi, 0xd05ef106
sub esi, 0xd05ef102
loop 0x401d7d
add eax, 0x57ca2e2b
sub eax, 0x57c940f0
xor ebx, ebx
add ebx, eax
add eax, 0xce7c1a41
add eax, 0x3183e5c4
mov ecx, 0x1b31eb3c
add ecx, 0xe50e14c4
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4216d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 0x30]
mov esi, dword [esp]
jmp 0x421701
lea edi, [esp + 4]
rdtsc
push edx
jmp 0x421708
rcl edi, 0xe
jnp 0x4216eb
jp 0x4216eb
mov ecx, dword [esp + 3]
jmp 0x421986
lea esp, [esp + 3]
mov dword [esp + 1], esi
mov dword [esp + 0xd], ecx
mov ebx, esi
jmp 0x421734
jmp 0x42174a
sub esp, 0xb8
mov esi, esp
sub esp, 0x17
je 0x4217e8
mov dword [esp + 1], esi
mov dword [esp + 0xd], ecx
mov ebx, esi
lea esp, [esp + 3]
jmp 0x421738

Function at 0x4238fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0412b60
jmp 0x423e13
push eax
pushfd
jmp 0x423d13
lea esp, [esp + 3]
push word [esp + 2]
jle 0x423d84
jg 0x423d84
pushal
stc
imul ecx, dword [eax], reloc.mscoree.dll__CorExeMain
dec eax
das
fisubr dword [edx - 0x45]
xchg edx, eax
bswap eax
xchg dword [esp + 2], ecx
jmp 0x422595
call 0x423d54
pop word [esp + 3]
mov byte [esp + 0x1a], dh
mov byte [esp + 0x17], al
jmp 0x423de6
lea esp, [esp + 2]
mov dword [esp + 0x28], esp
call fcn.00423dc4
pop dword [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x48], esi
pushal
jmp 0x423e29
btc cx, di
jl 0x423e37
bswap ecx
mov ebp, edi
cpuid
jmp 0x423e3c
mov dword [esp + 0x64], edi
lea esp, [esp + 0x64]
pushfd
jmp 0x423642
jmp 0x423ede
mov edi, dword [esp + 0x2c]
setb bl
lea edx, [edx + ebx]
neg ebp
jl 0x423e7c
xchg cl, bh
jmp 0x423e94
xchg cl, bh
jmp 0x423e94
jmp 0x423e66
mov esi, dword [esp]
neg si
jmp 0x423e9f
lea ebp, [esp]
rdtsc
neg eax
je 0x423e7e
jne 0x423ebd
sub esp, 0xc0
mov esi, esp
lea ecx, reloc.mscoree.dll__CorExeMain
mov ecx, 0xc2113b22
jmp 0x423ec5
mov esi, dword [esp]
neg si
jmp 0x423e9f
lea ecx, [eax*4]
bsf ax, cx
jne fcn.00423f04
je fcn.00423f04
invalid
bswap ecx
mov ebp, edi
cpuid
jmp 0x423e3c

Function at 0x423dc4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
mov dword [esp + 0x28], ebp
pushfd
push esi
pushal
push word [esp + 0x1a]
jmp 0x423df3
pop word [esp]
push word [esp]
jo 0x423dae
jno 0x423e09
push esi
pushal
jmp 0x423db8
mov dword [esp], eax
mov dword [esp + 0x28], ebp
pushfd
jmp 0x423dd0

Function at 0x426246
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb eax, ebp
rcl bl, cl
call fcn.004262a6
or ebx, dword [ebx + reloc.mscoree.dll__CorExeMain]
arpl sp, di
xchg edx, eax
cmc
add al, 0xc6
dec ecx

Function at 0x4262a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push bp
add esp, 1
rdtsc
lea esp, [esp + 1]
lea ebp, [ebp + 0x2a]
cpuid
jmp 0x4262df
mov dh, 0x4b
xchg dword [esp + 4], ebp
rdtsc
jmp 0x426290
bsf bx, dx
mov word [esp], sp
sub esp, 7
lea esp, [esp + 1]
jmp 0x4262fe
mov esi, 0xe4318446
bsf ax, sp
lea edx, [ecx*4]
lea ecx, [edi*4]
xchg dword [esp + 4], ebp
push cx
jmp 0x4262c9
push dword [esp + 0xc]
ret 0x10

Function at 0x4265f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl eax, 0x15
js 0x42661e
xchg dword [esp], edx
jmp 0x426640
jmp 0x42663d

Function at 0x46126c
Capabilities:
Hash data with md5

Disassembly:
push dword [esp + 3]
jmp 0x4612a0
lea esp, [esp + 8]
mov dword [eax + 8], 0x67452301
jmp 0x46128a