joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9e7440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e748c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e7452
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e74f0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e7542
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e7548
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9ffa35
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009ff6f5

Function at 0xa0482f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a046ae

Function at 0xa09de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa09e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa09e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x585f7961
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7e1a79e1
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401707
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + esi + 0x78]
lea edi, [eax + esi]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.004016da
pop ecx
test eax, eax
pop ecx
jne 0x40176e
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x401767
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.004016da
pop ecx
test eax, eax
pop ecx
jne 0x40176e
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x401747
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x1c]
lea eax, [eax + ebx*2]
movzx eax, word [eax + esi]
lea eax, [ecx + eax*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x401769

Function at 0xce4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ce41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xce407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xce406a
add dl, dl
jne 0xce4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xce40dc
xor eax, eax
add dl, dl
jne 0xce4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xce417d
add dl, dl
jne 0xce40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xce40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xce40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xce40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xce40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xce4075
mov eax, 1
add dl, dl
jne 0xce40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xce40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xce40e1
sub eax, ebx
mov ebx, 1
jne 0xce4128
mov ecx, 1
add dl, dl
jne 0xce410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xce4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xce4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xce4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xce413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xce414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xce4136
cmp eax, 0x7d00
jae 0xce416d
cmp eax, 0x500
jb 0xce4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xce4075
cmp eax, 0x7f
ja 0xce4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xce4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xce419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xce4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x60002430
Capabilities:
Accept command line arguments

Disassembly:
push 0x54
mov eax, 0x6001dfdd
call fcn.6001adcc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x60030380]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x60], edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6002e1d8]
cmp eax, dword [ecx + 4]
jg 0x6000258f
xor ebx, ebx
inc ebx
cmp byte [0x6002e1dc], 0
jne 0x600024d3
and dword [ebp - 0x5c], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x600024cd
xor edi, edi
cmp dword [ebp - 0x5c], edi
jle 0x600024c3
xor eax, eax
push dword [esi + eax*4]
lea ecx, [ebp - 0x28]
call fcn.6001ca40
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov ecx, 0x6002e1d0
call fcn.6001ca40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.60002111
inc edi
movzx eax, di
cmp eax, dword [ebp - 0x5c]
jl 0x60002492
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
mov edi, dword [ebp - 0x60]
mov byte [0x6002e1dc], bl
push edi
lea eax, [ebp - 0x58]
push 0x600210d4
push eax
call fcn.6001ca40
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push 0x600210d8
push eax
call fcn.6001ca40
add esp, 0x18
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
mov edi, 0x6002e1d0
push eax
mov ecx, edi
call fcn.6001ca40
jmp 0x6000255d
lea ecx, [ebp - 0x5c]
call fcn.60002207
lea ecx, [ebp - 0x58]
mov esi, eax
call fcn.60002dec
push eax
mov ecx, esi
call fcn.60002dec
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x60002577
lea ecx, [ebp - 0x40]
call fcn.60002dec
push eax
mov ecx, esi
call fcn.60002dec
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x60002577
lea ecx, [ebp - 0x5c]
call fcn.60002228
lea eax, [ebp - 0x60]
mov ecx, edi
push eax
call fcn.6001ca40
push eax
lea ecx, [ebp - 0x5c]
call fcn.6001ca40
test al, al
jne 0x60002511
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.60002111
lea ecx, [ebp - 0x58]
call fcn.60002111
mov al, bl
call fcn.6001ad76
ret
mov esi, 0x6002e1d8
push esi
call fcn.6001ca40
cmp dword [0x6002e1d8], 0xffffffff
pop ecx
jne 0x60002462
and dword [ebp - 4], 0
mov ecx, 0x6002e1d0
call fcn.6001ca40
push 0x6001fa60
call fcn.6001ca40
or dword [ebp - 4], 0xffffffff
push esi
call fcn.6001ca40
pop ecx
pop ecx
jmp 0x60002462

Function at 0x600039f8
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x6002c028]
call dword [sym.imp.kernel32.dll_TlsGetValue]
add eax, 4
ret
Function at 0x600066e3
Capabilities:
Print debug messages

Disassembly:
push 0x50
mov eax, 0x6001e3f2
call fcn.6001adcc
cmp byte [0x6002e2a1], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x60006814
push eax
lea ecx, [ebp - 0x28]
mov byte [0x6002e2a1], 1
call fcn.6001ca40
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push str.___ipc_rdr_channel
call fcn.6001ca40
mov esi, eax
cmp esi, 0xffffffff
je 0x6000680c
add esi, 0x13
lea ecx, [ebp - 0x28]
push esi
push str.___ipc_co_channel
call fcn.6001ca40
mov edi, eax
cmp edi, 0xffffffff
je 0x6000680c
push 0x60021328
lea ecx, [ebp - 0x40]
call fcn.6001ca40
sub edi, esi
mov byte [ebp - 4], 1
push edi
push esi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.6001ca40
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.6001ca40
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.60002111
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.6001ca40
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x600067a6
push str.___Sandbox_IPC_ComputeOnly_Client_connection_Failed
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x600067f6
test esi, esi
je 0x600067f6
push 0x60023618
push 0x18
call fcn.6001ca40
pop ecx
mov edx, eax
pop ecx
mov dword [ebp - 0x5c], edx
xor eax, eax
mov byte [ebp - 4], 3
test edx, edx
je 0x600067d5
push 6
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, edx
call fcn.6001ca40
mov byte [ebp - 4], 1
mov dword [0x600302f8], eax
test eax, eax
je 0x600067ec
push esi
mov ecx, eax
call fcn.6001ca40
jmp 0x600067f6
push 0
push esi
call fcn.6001ca40
pop ecx
pop ecx
cmp dword [0x600302f8], 0
lea ecx, [ebp - 0x40]
setne byte [0x6002e2a0]
call fcn.60002111
lea ecx, [ebp - 0x28]
call fcn.60002111
mov al, byte [0x6002e2a0]
call fcn.6001ad76
ret 8
Function at 0x60006719
Capabilities:
Print debug messages

Disassembly:
push 0x50
mov eax, 0x6001e3f2
call fcn.6001adcc
cmp byte [0x6002e2a1], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x60006814
push eax
lea ecx, [ebp - 0x28]
mov byte [0x6002e2a1], 1
call fcn.6001ca40
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push str.___ipc_rdr_channel
call fcn.6001ca40
mov esi, eax
cmp esi, 0xffffffff
je 0x6000680c
add esi, 0x13
lea ecx, [ebp - 0x28]
push esi
push str.___ipc_co_channel
call fcn.6001ca40
mov edi, eax
cmp edi, 0xffffffff
je 0x6000680c
push 0x60021328
lea ecx, [ebp - 0x40]
call fcn.6001ca40
sub edi, esi
mov byte [ebp - 4], 1
push edi
push esi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.6001ca40
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.6001ca40
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.60002111
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.6001ca40
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x600067a6
push str.___Sandbox_IPC_ComputeOnly_Client_connection_Failed
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x600067f6
test esi, esi
je 0x600067f6
push 0x60023618
push 0x18
call fcn.6001ca40
pop ecx
mov edx, eax
pop ecx
mov dword [ebp - 0x5c], edx
xor eax, eax
mov byte [ebp - 4], 3
test edx, edx
je 0x600067d5
push 6
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, edx
call fcn.6001ca40
mov byte [ebp - 4], 1
mov dword [0x600302f8], eax
test eax, eax
je 0x600067ec
push esi
mov ecx, eax
call fcn.6001ca40
jmp 0x600067f6
push 0
push esi
call fcn.6001ca40
pop ecx
pop ecx
cmp dword [0x600302f8], 0
lea ecx, [ebp - 0x40]
setne byte [0x6002e2a0]
call fcn.60002111
lea ecx, [ebp - 0x28]
call fcn.60002111
mov al, byte [0x6002e2a0]
call fcn.6001ad76
ret 8

Function at 0x60008742
Capabilities:
Get common file path

Disassembly:
push 0x180
mov eax, 0x6001e8e9
call fcn.6001adcc
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
push ebx
lea ecx, [ebp - 0x18c]
call fcn.6001ca40
push eax
lea ecx, [ebp - 0x184]
call fcn.60005ec9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14c]
push 0
call fcn.6001ca40
lea eax, [ebp - 0x184]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x14c]
push eax
push esi
push 0x25a
lea ecx, [edi + 4]
call fcn.6001ca40
lea ecx, [ebp - 0x14c]
mov esi, eax
call fcn.600061f7
lea ecx, [ebp - 0x184]
call fcn.600061f7
mov eax, esi
call fcn.6001ad76
ret 8
Function at 0x6000d470
Capabilities:
Allocate thread local storage

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x18], 4
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x6000d4bf
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
call fcn.6001ca40
int3

Function at 0x6001a2d3
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x6001f68e
call fcn.6001adcc
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x30], eax
xor eax, eax
stosd dword es:[edi], eax
push ebx
push ebx
push 1
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x38], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x6001a313
xor al, al
jmp 0x6001a40d
mov edi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [esi]
push dword [ebp - 0x30]
push dword [edi]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x6001a400
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x6001a402
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6002e1b0]
push ebx
push 0xffffffffffffffff
push ebx
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [edi + 4], 2
push ecx
setne al
inc eax
push eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.kernel32.dll_WaitForMultipleObjectsEx]
test eax, eax
je 0x6001a3ee
mov edi, dword [ebp - 0x30]
cmp eax, 1
jne 0x6001a402
mov esi, dword [0x6002e1b0]
push esi
mov dword [ebp - 0x30], esi
call sub.MSVCP140.dll__Mtx_lock
push eax
call fcn.6001ca40
mov eax, dword [0x6002e1b0]
mov dword [ebp - 4], ebx
push dword [eax + 0x38]
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.600023b0
mov ecx, dword [0x6002e1b0]
add esp, 0x14
mov dword [ecx + 0x44], eax
mov eax, dword [0x6002e1b0]
push dword [eax + 0x40]
call dword [sym.imp.kernel32.dll_SetEvent]
push esi
mov dword [ebp - 4], 1
call sub.MSVCP140.dll__Mtx_unlock
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
pop ecx
push ebx
push 0xffffffffffffffff
push ebx
push eax
push edi
call dword [sym.imp.kernel32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x6001a375
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
push ebx
push esi
lea eax, [ebp - 0x2c]
push eax
push dword [edi]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
je 0x6001a402
mov bl, 1
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, bl
call fcn.6001ad76
ret 8
Function at 0x6001a415
Capabilities:
Read file on windows

Disassembly:
push 0x3c
mov eax, 0x6001f6c6
call fcn.6001adcc
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edx, dword [0x60030380]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword fs:[0x2c]
mov edx, dword [eax + edx*4]
mov eax, dword [0x600302dc]
cmp eax, dword [edx + 4]
jg 0x6001a524
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
push ebx
push ebx
push 1
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x6001a472
xor al, al
jmp 0x6001a51c
mov edi, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
push eax
push esi
push dword [esi]
push dword [ebp - 0x30]
push dword [edi]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x6001a50f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x6001a511
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
jmp 0x6001a4e7
cmp eax, 1
jne 0x6001a511
push eax
push 0x113
push 0x113
jmp 0x6001a4d3
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
mov eax, 0x113
push eax
push eax
push dword [0x600302d8]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x6001a4b6
push 4
push 0x10
push 0xffffffffffffffff
lea eax, [ebp - 0x30]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
test eax, eax
jne 0x6001a4a4
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
push dword [edi]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
je 0x6001a511
mov bl, 1
push dword [ebp - 0x34]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, bl
call fcn.6001ad76
ret 8
mov edi, 0x600302dc
push edi
call fcn.6001ca40
cmp dword [0x600302dc], 0xffffffff
pop ecx
jne 0x6001a44f
mov dword [ebp - 4], ebx
call fcn.600023b0
or dword [ebp - 4], 0xffffffff
push edi
mov dword [0x600302d8], eax
call fcn.6001ca40
pop ecx
jmp 0x6001a44f
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40673a
pop dword [ebp - 0x14]
mov eax, 0x3625278b
sub eax, 0x35e4c051
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x6b38c68f
sub dword [ebp - 0x24], 0x1ce68144
mov dword [ebp - 0x20], 0xae8d018d
add dword [ebp - 0x20], 0x83a64ab8
mov dword [ebp - 0x1c], 0x7867e38
add dword [ebp - 0x1c], 0x44c5c5f6
mov dword [ebp - 0x18], 0x84e76fa3
add dword [ebp - 0x18], 0x7b18905d
lea eax, [ebp - 0x24]
push eax
mov eax, 0x56f1c8c1
sub eax, 0x56b147bd
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa2daa456
sub dword [ebp - 0x24], 0x2e683b00
mov dword [ebp - 0x20], 0xf53942e8
add dword [ebp - 0x20], 0x4c331e8d
mov dword [ebp - 0x1c], 0xea7eeb26
add dword [ebp - 0x1c], 0x78f08146
mov dword [ebp - 0x18], 0xddd48aa8
sub dword [ebp - 0x18], 0xddd48aa8
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xbe38ffeb
add eax, 0x42078115
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x37565
push 0
call eax
mov ecx, 0xe69a7714
sub ecx, 0xe69a2fcb
xor esi, esi
add esi, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x14]
mov ebx, 0x67f64d92
sub ebx, 0x70e294ef
sub dword [ebp - 4], ebx
mov edi, dword [edx]
sub dword [ebp - 0xc], ebx
sub edi, ebx
xor dword [ebp - 4], 0x5122907d
mov dword [esi], edi
mov dword [ebp - 0x10], 0xeb1fdea6
add esi, 0x30df9374
add esi, 0xcf206c90
add edx, 0xd89fc687
sub edx, 0xd89fc683
loop 0x406858
add eax, 0x2b6558fb
sub eax, 0x2b644904
mov ebx, eax
add eax, 0xad80a077
add eax, 0x527f5f8e
mov ecx, 0xb361685
add ecx, 0xf509e97b
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401c66
pop dword [ebp - 0x50]
mov eax, 0x401c66
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x89f6d378
add dword [ebp - 0x60], 0xc45b71d3
mov dword [ebp - 0x5c], 0xd5d5d1e8
add dword [ebp - 0x5c], 0x5c5d7a5d
mov dword [ebp - 0x58], 0x4aa6ce20
add dword [ebp - 0x58], 0x1a5760e
mov dword [ebp - 0x54], 0xf59575c0
sub dword [ebp - 0x54], 0xf59575c0
lea eax, [ebp - 0x60]
push eax
mov eax, 0xd90ee65d
sub eax, 0xd8ceb609
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x602a9666
sub dword [ebp - 0x60], 0xebb82d10
mov dword [ebp - 0x5c], 0x93837789
add dword [ebp - 0x5c], 0xade8e9ec
mov dword [ebp - 0x58], 0x4da9d4fb
add dword [ebp - 0x58], 0x15c59771
mov dword [ebp - 0x54], 0xfe3d9c96
sub dword [ebp - 0x54], 0xfe3d9c96
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x34592
push 0
call eax
mov ecx, 0x22b495a2
sub ecx, 0x22b4562a
xor esi, esi
add esi, eax
mov edi, 0x9ae759fa
sub edi, 0x9aa6e9fa
add edi, dword [ebp - 0x50]
mov ebx, 0xa1e4b4a
sub ebx, 0x3fc528d5
add dword [ebp - 0x2c], 0x222eddd8
mov edx, dword [edi]
xor dword [ebp - 0x1c], edi
add edx, ebx
xor dword [ebp - 0x10], edx
mov dword [esi], edx
xor dword [ebp - 0x3c], 0x4f90909d
add esi, 0x195c7d81
sub esi, 0x195c7d7d
add edi, 0xed21b4ee
add edi, 0x12de4b16
loop 0x401d80
add eax, 0x4b73a07d
add eax, 0xb48d5036
xor ebx, ebx
add ebx, eax
add eax, 0x9eb0f76b
sub eax, 0x9eb0f766
mov ecx, 0x481c5daa
sub ecx, 0x47dc5daa
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401720
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43bd38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x452450]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00402420
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00401650
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x401791
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.0041f5e1
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x4017ba
push dword [esp + 0xc]
call fcn.0041ff9d
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc