joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40633c
pop dword [ebp - 0x28]
mov eax, 0x75cd3479
add eax, 0x8a732ec3
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xa0ac7286
sub dword [ebp - 0x38], 0x525a2d3b
mov dword [ebp - 0x34], 0x758dfd4
sub dword [ebp - 0x34], 0xd525938f
mov dword [ebp - 0x30], 0x160e24b2
sub dword [ebp - 0x30], 0xc9c1e084
mov dword [ebp - 0x2c], 0x8a5e1497
add dword [ebp - 0x2c], 0x75a1eb69
lea eax, [ebp - 0x38]
push eax
mov eax, 0x90b04e43
add eax, 0x6f90221d
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x87d49e0d
add dword [ebp - 0x38], 0xec9dcb49
mov dword [ebp - 0x34], 0x31a7afc8
add dword [ebp - 0x34], 0xfc4b1ad
mov dword [ebp - 0x30], 0xa0451cdc
sub dword [ebp - 0x30], 0x3cd5b070
mov dword [ebp - 0x2c], 0xa3697788
sub dword [ebp - 0x2c], 0xa3697788
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa9b2b138
sub eax, 0xa9724038
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36495
push 0
call eax
mov ecx, 0xf429510d
add ecx, 0xbd6f59f
xor esi, esi
add esi, eax
mov edi, 0xfa9b2474
sub edi, 0xfa5a2474
add edi, dword [ebp - 0x28]
mov ebx, 0xb79ea3fa
sub ebx, 0xa5d75b1c
xor dword [ebp - 0x1c], 0x1377a565
mov edx, dword [edi]
mov dword [ebp - 0x20], 0x1ac5f34d
sub edx, ebx
mov dword [esi], edx
add esi, 4
add edi, 4
loop 0x406460
add eax, 0xaa851bba
add eax, 0x557bf1c9
xor ebx, ebx
add ebx, eax
add eax, 0xc7637e8a
sub eax, 0xc7637e85
mov ecx, 0xbfb00b62
add ecx, 0x408ff49e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4010b5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [0x812648]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x81264c]
xor esi, esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], esi
call fcn.00401053
mov eax, dword [0x812650]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [0x812654]
add ebx, 0x23f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
shl eax, 4
cmp dword [0x1e0320c], 0xc
mov dword [ebp - 4], eax
jne 0x4010df
push esi
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x1e0320c]
cmp eax, 0xfa9
jne 0x4010fb
mov dword [0x1e03208], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40110f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x1e0315c], esi
mov eax, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1e03204], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 8], eax
sub edi, dword [ebp - 8]
cmp dword [0x1e0320c], 0xc
mov dword [ebp - 4], eax
jne 0x401170
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea eax, [ebp - 0x38]
push eax
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + edi]
mov dword [ebp - 0x18], eax
mov eax, edi
shr eax, cl
add eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add ebx, 0x61c88647
dec dword [ebp - 0x20]
jne 0x4010ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ecx
pop ebx
leave
ret 4
Function at 0x4051cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8112a8]
jne 0x4051d5
repz ret
jmp fcn.0040b4d7

Function at 0x40bf4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407cac
and dword [ebp - 4], 0
cmp dword [0x81ba04], 0
mov ebx, eax
jne 0x40bffb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c0ac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40c0ac
push eax
call fcn.00407c3a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81ba04], eax
call esi
push eax
call fcn.00407c3a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81ba08], eax
call esi
push eax
call fcn.00407c3a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81ba0c], eax
call esi
push eax
call fcn.00407c3a
pop ecx
mov dword [0x81ba14], eax
test eax, eax
je 0x40bffb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407c3a
pop ecx
mov dword [0x81ba10], eax
mov eax, dword [0x81ba10]
cmp eax, ebx
je 0x40c053
cmp dword [0x81ba14], ebx
je 0x40c053
push eax
call fcn.00407cb5
push dword [0x81ba14]
mov esi, eax
call fcn.00407cb5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c053
test edi, edi
je 0x40c053
call esi
test eax, eax
je 0x40c04a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c04a
test byte [ebp - 0xc], 1
jne 0x40c053
or dword [ebp + 0x10], 0x200000
jmp 0x40c08c
mov eax, dword [0x81ba08]
cmp eax, ebx
je 0x40c08c
push eax
call fcn.00407cb5
pop ecx
test eax, eax
je 0x40c08c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c08c
mov eax, dword [0x81ba0c]
cmp eax, ebx
je 0x40c08c
push eax
call fcn.00407cb5
pop ecx
test eax, eax
je 0x40c08c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81ba04]
call fcn.00407cb5
pop ecx
test eax, eax
je 0x40c0ac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c0ae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403203
pop dword [ebp - 0x3c]
mov eax, 0x403203
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb273a594
sub dword [ebp - 0x4c], 0x64216049
mov dword [ebp - 0x48], 0xd9441ba
sub dword [ebp - 0x48], 0xdb60f575
mov dword [ebp - 0x44], 0xebce6fe
sub dword [ebp - 0x44], 0xc270a2d0
mov dword [ebp - 0x40], 0xdd63e77f
add dword [ebp - 0x40], 0x229c1881
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xbdf6d930
sub eax, 0xbdb658a4
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa7db0c53
add dword [ebp - 0x4c], 0xcc975d03
mov dword [ebp - 0x48], 0x26bf5232
add dword [ebp - 0x48], 0x1aad0f43
mov dword [ebp - 0x44], 0xcbfe60c1
sub dword [ebp - 0x44], 0x688ef455
mov dword [ebp - 0x40], 0xf8a694fa
add dword [ebp - 0x40], 0x7596b06
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xa5c5db63
add eax, 0x5a7aa571
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34df5
push 0
call eax
mov ecx, 0x11791266
add ecx, 0xee872eb7
mov edx, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x3c]
mov edi, 0x13929849
add dword [ebp - 0x38], 0x20dd2fce
mov esi, dword [ebx]
add dword [ebp - 0x2c], 0x73c5b685
xor esi, edi
xor dword [ebp - 8], 0x4cffd022
mov dword [edx], esi
sub dword [ebp - 0x2c], 0xa33ea916
add edx, 0xe842da1b
sub edx, 0xe842da17
add ebx, 4
loop 0x403314
add eax, 0x60542ef0
sub eax, 0x605337a9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x367249d5
add ecx, 0xc9cdb62b
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x100060a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1001e08c
push edi
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100060ca
push edi
push 0x64
call fcn.10016d80
add esp, 8
mov edi, dword [sym.imp.MSVCR100.dll_fseek]
push 2
push 0
push esi
call edi
push esi
call dword [sym.imp.MSVCR100.dll_ftell]
push 0
push 0
push esi
mov ebx, eax
call edi
lea eax, [ebx + 1]
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 0x20
mov dword [ebp - 4], edi
test edi, edi
jne 0x10006107
push 0x67
call fcn.10016d80
add esp, 4
lea eax, [ebx + 1]
push eax
push 0
push edi
call sub.MSVCR100.dll_memset
push esi
push ebx
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
push 0x190
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, eax
add esp, 0x24
test ebx, ebx
jne 0x10006143
push 0x67
call fcn.10016d80
add esp, 4
push str.__t_r_n
push edi
mov edi, dword [sym.imp.MSVCR100.dll_strtok]
call edi
add esp, 8
mov esi, 1
lea esp, [esp]
test eax, eax
je 0x1000618c
push str.__t_r_n
push 0
mov dword [ebx + esi*4], eax
call edi
inc esi
add esp, 8
cmp esi, 0x64
jl 0x10006160
test eax, eax
je 0x1000618c
push str.option_table
push 0x66
call fcn.10016d80
add esp, 8
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
call fcn.100057c0
mov esi, dword [sym.imp.MSVCR100.dll_free]
push ebx
call esi
mov edx, dword [ebp - 4]
push edx
call esi
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b2b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push 0x1001e290
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001b2d3
pop edi
pop esi
pop ebp
ret
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push edi
push 1
push ecx
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
xor ecx, ecx
cmp eax, dword [esi + 0xc]
push edi
sete cl
mov esi, ecx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x1001c060
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x1001c084
push 0x10025ae0
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
pop ebp
ret

Function at 0x1001c0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
xor edx, edx
add esp, 0x10
cmp eax, esi
sete dl
pop esi
mov eax, edx
pop ebp
ret

Function at 0x1001c0fa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022994]
jne 0x1001c104
repz ret
jmp fcn.1001c4b7
Function at 0x485070
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x67000]
push edi
or ebp, 0xffffffff
jmp 0x485092
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x485099
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485088
mov eax, 1
add ebx, ebx
jne 0x4850ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4850bc
jne 0x4850db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4850db
dec eax
add ebx, ebx
jne 0x4850c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4850a0
add ebx, ebx
jne 0x4850d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48512d
xor ecx, ecx
sub eax, 3
jb 0x4850f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x485162
sar eax, 1
mov ebp, eax
jmp 0x4850fe
add ebx, ebx
jne 0x4850fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4850cc
inc ecx
add ebx, ebx
jne 0x48510c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4850cc
add ebx, ebx
jne 0x485119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48510e
jne 0x48512a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48510e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48514c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48513e
jmp 0x48508e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48514c
add edi, ecx
jmp 0x48508e
pop esi
lea edi, [esi + 0x83000]
mov eax, dword [edi]
or eax, eax
je 0x4851b4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x85430]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x854f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x485169
mov ecx, edi
jns 0x485198
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x854fc]
or eax, eax
je 0x4851ae
mov dword [ebx], eax
add ebx, 4
jmp 0x485186
call dword [esi + 0x8550c]
mov ebp, dword [esi + 0x85500]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4851e8
sub esp, 0xffffff80
jmp 0x456cad
Function at 0x405afd
Capabilities:
Hide graphical window

Disassembly:
cmp byte [0x40bc12], 3
je 0x405b76
cmp byte [0x40bc12], 4
je 0x4058ad
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0041a006
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a006
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0041a006
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40288e
pop dword [ebp - 0x3c]
mov eax, 0x6fa79508
add eax, 0x90989386
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x6e63e615
add dword [ebp - 0x4c], 0xdfee5f36
mov dword [ebp - 0x48], 0x71f638ea
sub dword [ebp - 0x48], 0x3fc2eca5
mov dword [ebp - 0x44], 0xe2d46119
add dword [ebp - 0x44], 0x6977e315
mov dword [ebp - 0x40], 0xbb9d6705
add dword [ebp - 0x40], 0x446298fb
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x5ed9c93b
add eax, 0xa166a729
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa0f7cbe4
add dword [ebp - 0x4c], 0xd37a9d72
mov dword [ebp - 0x48], 0x8c5422b3
add dword [ebp - 0x48], 0xb5183ec2
mov dword [ebp - 0x44], 0x5994d173
sub dword [ebp - 0x44], 0xf6256507
mov dword [ebp - 0x40], 0x71bf3106
sub dword [ebp - 0x40], 0x71bf3106
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba22
push 0
call eax
mov ecx, 0x5444c636
sub ecx, 0x54446a10
xor esi, esi
add esi, eax
mov edx, 0xc8fc1a8f
sub edx, 0xc8bb1a8f
add edx, dword [ebp - 0x3c]
mov ebx, 0xfa0b12f
xor dword [ebp - 8], 0x88e67590
mov edi, dword [edx]
sub dword [ebp - 0x34], 0x67dc9e85
add edi, ebx
mov dword [esi], edi
mov dword [ebp - 0xc], 0x13f79edf
add esi, 0xc579c302
sub esi, 0xc579c2fe
add edx, 4
loop 0x4029a7
add eax, 0x1636b
xor ebx, ebx
add ebx, eax
add eax, 0x7a251f38
sub eax, 0x7a251f33
mov ecx, 0x757ea246
sub ecx, 0x753ea246
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x440790
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481634
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x4a4100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], esi
push 0x4a7710
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x4a7728], 0
je 0x4407f8
test esi, esi
je 0x440eed
movups xmm0, xmmword [0x4a7739]
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x4a7749]
movups xmmword [esi + 0x10], xmm0
jmp 0x440eed
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x14], eax
call fcn.0040a916
mov ecx, eax
test ecx, ecx
je 0x440f15
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xf8], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0xf4]
mov dword [ebp - 0x14], eax
call fcn.0040a916
mov ecx, eax
test ecx, ecx
je 0x440f15
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x14], eax
call fcn.0040a916
mov ecx, eax
test ecx, ecx
je 0x440f15
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xf0], eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0xec]
mov dword [ebp - 0x14], eax
call fcn.0040a916
mov ecx, eax
test ecx, ecx
je 0x440f15
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xec], eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xfc], 0
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x160]
call fcn.00440510
mov byte [ebp - 4], 9
mov byte [ebp - 0x26a], 1
mov byte [ebp - 0x269], 1
mov dword [ebp - 0x100], 0
call fcn.0040a916
mov ecx, eax
test ecx, ecx
je 0x440f15
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x100], eax
mov byte [ebp - 4], 0xb
xorps xmm0, xmm0
push 0x40
lea eax, [ebp - 0x1f8]
push 0
push eax
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x40], xmm0
call fcn.004557e0
push 0x40
lea eax, [ebp - 0x1a0]
push 0
push eax
call fcn.004557e0
lea eax, [ebp - 0xf8]
invalid
test dword [edi + edi*8], ebx
invalid
invalid