joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x4061dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40626e
lea eax, [ebp - 0x104]
push eax
call fcn.004063be
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x406337
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x406377
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x406377
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40631c
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x406377
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40636c
push 0x3e8
call eax
test eax, eax
je 0x40636c
call 0x40635c
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x5f06e2
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5da33a
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x5da356
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x5da342
jmp 0x5da361
ret
call 0x5f06c1
lea esp, [esp + 4]
call 0x5f06c3
jmp 0x5da32f

Function at 0x6063c2
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
and ebx, ecx
lea esp, [esp + 0x2c]
xor edi, dword [ebx*4 + 0x5e3340]
jmp 0x606436
add esp, 1
jmp 0x6063a2
setbe bh
movzx ebx, byte [esi + 2]
pushal
mov dword [esp + 0x17], esi
call fcn.0060641f
sbb byte [edx], 0x88
out dx, eax
sbb ch, byte [ebx + edi*8 + 0x2fdc4dd2]

Function at 0x60641f
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x6065e6
and edx, ecx
sub esp, 0xe
pop word [esp + 1]
clc
pop dword [esp]
jmp 0x60659f
sub esp, 0xc
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + 0x5e2f40]
movzx ebx, byte [esi + 5]
jmp 0x606462
mov ebx, dword [edx]
pop edx
cmc
and ebx, ecx
cmc
jmp 0x606480
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + 0x5e3740]
dec edx
jmp 0x60653d
and edx, ecx
jmp 0x6064b0
lea ebp, [ebp + 0x5e2740]
mov edx, dword [ebp]
pop ebp
stc
sub esp, 0x10
mov dword [esp + 7], eax
jmp 0x6064ce
lea esp, [esp + 2]
pushal
mov al, ah
mov esi, dword [esp]
mov dword [esp], edx
jmp 0x60650c
sub esp, 0xc
push word [esp + 9]
lea esp, [esp + 2]
lea esp, [esp + 0xc]
jmp 0x60657a
mov ebx, dword [ebx*4 + 0x5e2740]
mov di, 0x2661
bt edi, edx
sub esp, 6
lea edi, [edx + edx]
jmp 0x6064f9
mov edx, dword [esi + 4]
mov dword [esi], edi
lea edi, [esp + ebp]
jmp 0x606522
popal
push edx
push word [esp + 1]
call fcn.00606561
push ebp
mov ebp, edx
lea ebp, [ebp*4]
jmp 0x6064e5
push edx
mov edx, ebx
lea edx, [edx*4]
lea edx, [edx + 0x5e2740]
jmp 0x6064a7
Function at 0x6067ff
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
jmp 0x6067a2
lea esp, [esp + 2]
jmp 0x6066ef
mov edi, edx
sub esp, 0x14
clc
push word [esp + 0x13]
mov word [esp + 8], bx
jmp 0x6066b1
mov edi, dword [edi*4 + 0x5e2740]
jmp 0x606786
shr edi, 0x18
pushal
pop word [esp + 0xd]
mov byte [esp + 0x18], dh
lea esp, [esp + 2]
jmp 0x6066d9
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x5e2740]
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x6066c7
mov dh, byte [esp]
setg dh
neg edx
mov edx, dword [esi + 8]
cmc
jmp 0x606706
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + 0x5e3340]
bswap ebx
stc
mov bx, word [esp]
jmp 0x60678c
push edx
push edx
mov dword [esp + 0x18], edi
call fcn.0060672d
lea ebx, [ebx*4]
lea ebx, [ebx + 0x5e2b40]
mov edi, dword [ebx]
pop ebx
and ebx, ecx
jmp 0x606734
and edi, ecx
push ebx
pushal
jmp 0x606754
bsf bx, si
jmp 0x6067ba
pushal
lea esp, [esp + 2]
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0x5e3740]
mov edx, dword [esp]
jmp 0x60671f
movzx ebx, byte [esi + 0xa]
pushal
push dword [esp + 0xc]
mov ebx, dword [ebx*4 + 0x5e2740]
jmp 0x6067d0
pushal
pop dword [esp + 0x14]
lea esp, [esp + 0xb]
pop word [esp + 4]
jmp 0x6067f3
lea esp, [esp + 3]
and ebx, ecx
call 0x6067ff
mov eax, dword [0x1247488]
lea esp, [esp + 0x34]
jmp 0x60686c
and edx, ecx
pushal
add esp, 0x1b
lea esp, [esp + 1]
jmp 0x606828
xor edi, dword [ebx*4 + 0x5e2f40]
mov bl, byte [esp]
lea ebx, [esi + 0x7d]
mov ebx, dword [esp]
movzx ebx, byte [esi + 0xd]
jmp 0x606849

Function at 0x60692c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 1]
push esp
lea esp, [esp + 2]
jmp 0x606908
mov edi, dword [edi*4 + 0x5e2740]
call 0x60692c
int 0x4a
fdivr dword [edi - 0x7d9405b6]
cmp eax, 0x8de69f0c
and al, 2
lea esp, [esp + 2]
shr edi, 0x18
call fcn.006068f8
and edi, ecx
call fcn.00606955
pop ss
xchg ecx, eax
add dword [eax - 0x6d], esp
push edi
xchg edi, eax
adc al, byte [eax + 0x13a212e7]
mov ah, byte [0xec83fa8b]
push cs
push dword [esp + 8]
sub esp, 0x16
push word [esp + 0x13]
jmp 0x606920

Function at 0x606955
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 4
pop word [esp + 1]
jmp 0x6069a6
sub esp, 0xc
push esp
push word [esp + 5]
lea esp, [esp + 2]
lea esp, [esp + 0x4c]
jmp 0x6069b8
mov byte [esp], ch
lea esp, [esp + 2]
mov edi, dword [edi*4 + 0x5e2b40]
and ebx, ecx
jmp 0x606983
xor edi, dword [ebx*4 + 0x5e3340]
bsr bx, bp
sub bl, ch
lea ebx, [ebp - 0x3f]
jmp 0x606c2f

Function at 0x606973
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + 0x5e2740]
jmp 0x606942
mov edx, dword [esi + 0xc]
push edx
mov dword [esi + 8], edi
mov di, word [esp]
jmp 0x6068d0
mov edi, edx
sub esp, 0xe
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + 0x5e3740]
jmp 0x6068eb
Function at 0x6069da
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
mov edx, dword [edx*4 + 0x5e2740]
pushal
pop dword [esp + 0xa]
jmp 0x606b7f
pushal
lea esp, [esp + 0x20]
dec dword [ebp - 4]
call fcn.006069ff
and edx, ecx
clc
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0x5e3740]
jmp 0x606a1a
sub esp, 0xc
cmc
jmp 0x606a49
lea esp, [esp + 2]
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + 0x5e2f40]
cmc
cmc
jmp 0x606aad
add esp, 5
push dword [esp + 0x16]
lea esp, [esp + 3]
and ebx, ecx
sub esp, 0xe
jmp 0x606ac6

Function at 0x606a33
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], sp
mov word [esp], di
jmp 0x606a6f
mov byte [esp + 2], ah
and al, 2
lea esp, [esp + 8]
jne 0x5d84a1
je 0x5d8452
jne 0x606a70
jnp 0x606aa5
in eax, dx
das
popfd
or al, 0x82
in eax, 0x14
mov al, byte [0xb25b7819]
lodsd eax, dword [esi]
lcall 0x16a7, 0x15e68313
add dword [ebx - 0x140af314], 0x50c25696
aaa
ret 0x1404

Function at 0x6071db
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
mov word [esp + 2], dx
lea esp, [esp + 2]
jmp 0x6071fd
lea esp, [esp + 4]
cmp bl, 0x7a
push esp
lea esp, [esp + 4]
jmp 0x6072e2
add edx, dword [edx - 0x73]
and al, 3
ljmp 0xf161:0xfccc7c8d
jbe 0x5d86e0
ja 0x5d86c3
jge 0x6072d7
ja 0x607304
loope 0x60734f
test dword [eax], ebx
mov gs, ecx
sbb ah, bl
aad 0x75
in eax, 0x8c
jg 0x6072fa
in al, 0x17
jle 0x607291
dec eax
dec dword [edx + 0x4d892414]
cld
invalid

Function at 0x60c00e
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx eax, byte [esi + 0xb]
mov byte [esi + 0x5b], al
movzx ecx, byte [esi + 0xc]
jmp 0x60c032
lea esp, [esp + 4]
mov byte [esi + 0x5a], dl
rdtsc
jmp 0x60bfef
mov byte [esi + 0x5c], cl
push edx
lea eax, [edi + ebp]
jmp 0x60c042
push esp
mov dx, 0x6777
xchg dword [esp], edx
rdtsc
lea esp, [esp + 4]
jmp 0x60c019
lea esp, [esp + 4]
movzx edx, byte [esi + 0xd]
lea edi, [esp + ebp]
jmp 0x60c60c

Function at 0x60d3df
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xchg cx, dx
xchg edi, eax
jmp 0x60d3c4
lea esp, [esp + 4]
movzx eax, al
not ch
sub esp, 0x1c
jmp 0x60d41d
mov ecx, dword [esp + 0x10]
rdtsc
jmp 0x60d406
rol edx, 3
jmp 0x60d3b6
lea eax, [ecx + ebx]
jmp 0x60d467
lea esp, [esp + 0x1c]
mov dword [esp + 0x28], eax
jmp 0x60cf69
mov edx, dword [esp + 0x3c]
lea edi, [ebx + edi]
mov esi, 0x851bf2be
sub esp, 0xc
jmp 0x60d49b
sub eax, edx
jmp 0x60d437
cdq
mov si, 0xc967
mov di, 0xe3ad
mov cl, 0xba
jmp 0x60d450
lea esp, [esp + 0xc]
mov eax, dword [esp + 0x24]
ror edi, 0x13
mov ch, bh
xchg ecx, edi
jmp 0x60d4c4
mov esi, eax
bts edi, edi
sub esp, 0
jmp 0x60d474
Function at 0x60d635
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pop word [esp]
lea esp, [esp + 2]
jmp 0x60d877
cmp dword [esp + 0x10], ebx
push edx
mov dword [esp], esi
pop word [esp]
jmp 0x60d8f3
lea ebx, [esi - 1]
push esp
push edx
call 0x60d635
inc edx
lea esp, [esp + 0xc]
jmp 0x60d69c
lea esp, [esp + 4]
jle 0x60cf05
jg 0x60d62a
inc ebp
rol byte [eax + 0x27], cl
shl byte [esi - 0x2d], cl
dec edx
in eax, 0x14
xchg dword [esi], ebp
je 0x60cead
test ecx, ecx
push edx
pop word [esp]
push word [esp + 1]
jmp 0x60d654
push dword [esp]
lea esp, [esp + 8]
jmp 0x60d66c
mov dword [esp + 0x14], ebx
jmp 0x60d14d
inc esi
call 0x60d87e
xchg edx, eax
lea esp, [esp + 3]
call fcn.0060d8a3
sbb eax, 0x97641d8d
lea ebx, es:[esi]
mov ebx, gs
xchg ebp, eax
out dx, eax
mul cl
test eax, eax
jne 0x60cf34
jmp 0x60d14d
lea esp, [esp + 2]
jle 0x60cf69
jmp 0x60cead

Function at 0x60d8a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0x60d8b1
mov dword [esp + 0x10], esi
jmp 0x60d14d

Function at 0x72529a
Capabilities:
Parse pe header

Disassembly:
call fcn.0072502e
mov byte [esp + 1], dh
pushal
jmp 0x7252b9
lea esp, [esp + 1]
mov dword [esp + 0xe0], esi
push esp
lea esp, [esp + 1]
call 0x72529a
add eax, 0xff66a7b4
je 0x725299
adc bh, bh
je 0x72529d
or ecx, dword [ecx - 0x17f4dbb4]
cdq
invalid
pop word [esp + 2]
lea esp, [esp + 2]
mov word [esp], sp
mov word [esp], bx
jmp 0x725307
wait
mov word [esp], dx
mov word [esp + 1], di
and al, 0x66
mov dword [esp + 1], edi
jmp 0x725283
mov word [esp + 0x20], sp
pop dword [esp + 5]
pop dword [esp]
mov dword [esp + 0x10], ebp
pushal
pop dword [esp + 0x29]
jmp 0x725259
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x72535e
lea esp, [esp + 3]
mov dword [esp + 0xdc], edi
lea esp, [esp + 0xdc]
mov eax, dword fs:[0x30]
jmp 0x7252e9
mov eax, dword [eax + 8]
push eax
jmp 0x725029
Function at 0x405c8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422aa4], 0
push esi
jne 0x405cc3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c9d
mov dword [ecx*4 + 0x422aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c98
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cf4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405cd6
pop edi
not eax
pop esi
ret 0xc

Function at 0x40697e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1244], 0
push esi
jne 0x4069b5
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40698f
mov dword [ecx*4 + 0x7a1240], eax
inc ecx
cmp ecx, 0x100
jl 0x40698a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4069e6
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1240]
xor eax, esi
inc ecx
dec edx
jne 0x4069c8
pop edi
not eax
pop esi
ret 0xc
Function at 0x405c89
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x405cd8
mov dword [ebp - 4], 0
jmp 0x405cb0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xa
jge 0x405cd3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405cd1
jmp 0x405cd3
jmp 0x405ca7
jmp 0x405dbe
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x405cf7
jmp 0x405dbe
lea edx, [ebp - 0x660]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov word [ebp - 0x630], 0
mov eax, dword [ebp - 0x634]
or al, 0x81
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x654], str.Cleanup...
push 0x104
lea ecx, [ebp - 0x61c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.00409d90
add esp, 8
push str._CLEANUP
lea eax, [ebp - 0x414]
push eax
call fcn.00409da0
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.00409da0
add esp, 8
push 0x412140
lea eax, [ebp - 0x660]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x518]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x405dc2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [str.ARM.TMP]
mov dword [ebp - 0x31c], eax
mov ecx, dword [0x411364]
mov dword [ebp - 0x318], ecx
mov dl, byte [0x411368]
mov byte [ebp - 0x314], dl
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x310]
push ecx
call fcn.00409f50
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405e25
mov edx, dword [ebp - 4]
mov byte [edx + 1], 0
jmp 0x405e39
push 0x4125a4
lea eax, [ebp - 0x310]
push eax
call fcn.00409d90
add esp, 8
push 0x104
lea ecx, [ebp - 0x424]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x424]
push edx
call fcn.00409f50
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405ebe
mov eax, dword [ebp - 4]
add eax, 1
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00409d90
add esp, 8
push 0x2e
lea edx, [ebp - 0x108]
push edx
call fcn.00409f50
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405eab
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00409e90
add esp, 8
mov dword [ebp - 4], eax
push str..TMP
mov ecx, dword [ebp - 4]
push ecx
call fcn.00409d90
add esp, 8
jmp 0x405ed2
push 0x4125a8
lea edx, [ebp - 0x108]
push edx
call fcn.00409d90
add esp, 8
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x320], 1
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x405f44
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x310]
push eax
call fcn.00405f7a
add esp, 8
and eax, 0xff
test eax, eax
jne 0x405f1e
mov byte [ebp - 0x320], 0
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00405f7a
add esp, 8
and eax, 0xff
test eax, eax
jne 0x405f44
mov byte [ebp - 0x320], 0
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.00405f7a
add esp, 8
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00405f7a
add esp, 8
mov al, byte [ebp - 0x320]
mov esp, ebp
pop ebp
ret
Function at 0x405f7a
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov byte [ebp - 0x250], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.00409d90
add esp, 8
push 0
lea edx, [ebp - 0x248]
push edx
call fcn.00409e90
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00409d90
add esp, 8
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x405fec
mov al, byte [ebp - 0x250]
jmp 0x40604f
mov ecx, 1
test ecx, ecx
je 0x40603c
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00409d90
add esp, 8
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x406020
mov byte [ebp - 0x250], 0
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40603a
jmp 0x40603c
jmp 0x405fec
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x250]
mov esp, ebp
pop ebp
ret

Function at 0x406053
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
and eax, 0xff
test eax, eax
je 0x406074
push 0xffffffffffffffff
mov ecx, dword [0x412140]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 8]
push edx
mov eax, dword [0x412140]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x412144]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x412140]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004054d8
call dword [0x412264]
mov eax, dword [0x412378]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x412480]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x412258]
mov eax, dword [edx]
sub eax, 1
mov ecx, dword [0x412258]
mov dword [ecx], eax
mov edx, dword [0x412258]
xor eax, eax
cmp dword [edx], 0
sete al
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
test ecx, ecx
je 0x40611d
xor edx, edx
mov dl, byte [0x41225c]
test edx, edx
jne 0x40611d
push 0x412150
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40611d
push 0
push 0x412150
call fcn.00405c89
add esp, 8
xor eax, eax
mov al, byte [0x41225c]
neg eax
sbb al, al
not al
and eax, dword [ebp - 4]
push eax
call fcn.00405dc2
add esp, 4
mov ecx, dword [0x412258]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [0x412138]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x406157
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push str.ArmAccess
mov eax, dword [0x412378]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x40618a
mov eax, 1
jmp 0x406226
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push 0x411380
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str..mailslotclient_
lea edx, [ebp - 0x100]
push edx
call fcn.00409d90
add esp, 8
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.00409da0
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x412484], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x412484]
push edx
mov eax, dword [0x412480]
push eax
call dword [ebp - 0x208]
add esp, 0x10
mov dword [ebp - 0x204], eax
mov ecx, dword [0x412484]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x204]
mov esp, ebp
pop ebp
ret
Function at 0x40716f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4071a4
mov dword [0x412494], 1
xor al, al
jmp 0x407261
mov eax, dword [ebp - 8]
and eax, 0x80000000
test eax, eax
je 0x4071c0
mov ecx, dword [ebp - 8]
and ecx, 0x7fffffff
mov dword [ebp - 8], ecx
mov byte [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x407257
cmp dword [ebp + 0xc], 0
je 0x407245
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4071fa
mov dword [0x412494], 1
xor al, al
jmp 0x407261
cmp dword [ebp + 0x14], 0
je 0x407214
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040439b
add esp, 0xc
mov eax, dword [ebp - 0xc]
and eax, 0xff
test eax, eax
jne 0x407243
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00404559
add esp, 0xc
and eax, 0xff
test eax, eax
jne 0x407243
xor al, al
jmp 0x407261
jmp 0x407257
push 1
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x407465
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [0x41236c], 1
lea eax, [ebp - 4]
push eax
push 0
push 0x412140
push 0x405534
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x412374], eax
xor ecx, ecx
mov cl, byte [0x41236c]
cmp ecx, 1
jne 0x4074a8
push 0
push 0x7d
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x40748f
mov esp, ebp
pop ebp
ret