joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405766
Capabilities:
Get common file path

Disassembly:
push 0x46c
push 0x42a660
call fcn.00412d70
mov esi, ecx
call fcn.0040639e
cmp eax, 3
jae 0x40579e
push str.Global639
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40579e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
and dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, esi
call fcn.0040595f
test eax, eax
je 0x4057bc
or dword [ebp - 4], 0xffffffff
jmp 0x405957
mov ecx, esi
call fcn.00405418
mov dword [ebp - 0x64], eax
test eax, eax
jne 0x4057b3
call fcn.0040639e
cmp eax, 3
jae 0x4057e5
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, esi
call fcn.00405a7c
test eax, eax
jne 0x4057b3
mov ecx, esi
call fcn.00405b5a
test eax, eax
jne 0x4057b3
mov ecx, esi
call fcn.00405640
test eax, eax
jne 0x4057b3
call fcn.0040639e
cmp eax, 3
jae 0x405828
lea eax, [ebp - 0x47c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
push 0x40
pop ecx
mov dword [ebp - 0x1c], ebx
movzx eax, word [esi + 0x6e]
cmp ebx, eax
jae 0x4058e6
mov eax, ebx
imul eax, eax, 0x28
add eax, dword [esi + 0x160]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x60], 0x10
mov dword [ebp - 0x5c], 0x10
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x54], 0x20
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 0x24]
test cl, 0x20
je 0x4058a3
or ecx, 0x60000000
mov dword [eax + 0x24], ecx
push 0x42fcd0
push 1
mov ecx, 0x42fb70
call fcn.0040d9d1
lea ecx, [ebp - 0x68]
push ecx
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x24]
shr ecx, 0x1d
push dword [ebp + ecx*4 - 0x60]
push dword [edx + 8]
mov ecx, dword [edx + 0xc]
add ecx, dword [esi + 0xc]
push ecx
call dword [eax]
test eax, eax
jne 0x4058e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4057b3
inc ebx
jmp 0x40582a
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x4058f8
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [esi + 0x24], eax
test byte [esi], 1
jne 0x405932
mov eax, 0x2000
test word [esi + 0x7e], ax
je 0x405932
mov eax, dword [esi + 0x24]
test eax, eax
je 0x405932
mov dword [ebp - 4], 1
push 0
push 1
push dword [esi + 0xc]
call eax
test eax, eax
jne 0x40592e
or dword [ebp - 4], 0xffffffff
mov eax, 0x45a
jmp 0x405957
and dword [ebp - 4], 0
or dword [esi], 0x80
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x405957
call fcn.00412dab
ret 8
Function at 0x40595f
Capabilities:
Parse pe header

Disassembly:
push 8
push 0x42a690
call fcn.00412d70
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 0x28]
push dword [ebp + 0xc]
push 0x40
push ebx
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405a6d
or dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x405a5c
cmp dword [esi + 0x64], ebx
je 0x405a5c
call fcn.0040639e
cmp eax, 3
jae 0x4059c4
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x4059c4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 1
lea edi, [esi + 0x68]
push dword [ebp + 0xc]
push pe_nt_image_headers32
push dword [esi + 0x64]
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405a6d
or dword [ebp - 4], 0xffffffff
cmp dword [edi], 0x4550
jne 0x405a5c
mov eax, 0x10b
cmp word [esi + 0x80], ax
jne 0x405a5c
movzx eax, word [esi + 0x6e]
test ax, ax
je 0x405a5c
mov edi, eax
imul edi, edi, 0x28
movzx ecx, word [esi + 0x7c]
mov ebx, dword [esi + 0x64]
add ecx, 0x18
add ebx, ecx
push edi
call fcn.0041510d
pop ecx
mov dword [esi + 0x160], eax
test eax, eax
jne 0x405a31
push 8
jmp 0x405a73
mov dword [ebp - 4], 2
push dword [ebp + 0xc]
push edi
push ebx
push eax
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405a6d
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + edi]
mov dword [esi + 0x10], eax
xor eax, eax
jmp 0x405a74
push 0xb
jmp 0x405a73
or dword [ebp - 4], 0xffffffff
push 0x1e
pop eax
call fcn.00412dab
ret 8
Function at 0x405c55
Capabilities:
Get common file path

Disassembly:
sub esp, 0x41c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push esi
mov esi, dword [esp + 0x430]
push edi
mov edi, dword [esi]
and edi, 0x7fffffff
mov ebx, edi
or ebx, 0x80000000
jmp 0x405c86
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
push esi
call ebp
cmp edi, eax
jne 0x405c7e
lea eax, [esi + 4]
push eax
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x405da8
call fcn.0040639e
cmp eax, 3
jae 0x405cbf
lea eax, [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, dword [esp + 0x430]
mov eax, dword [esi]
mov ecx, dword [ebx + 0x3c]
test al, 8
je 0x405cfe
mov eax, dword [esi]
test eax, 0x40000000
je 0x405da8
mov eax, dword [ecx + ebx + 0x88]
push 0
push esi
push dword [ecx + ebx + 0x8c]
add eax, ebx
push eax
push ebx
call fcn.004060ea
add esp, 0x14
jmp 0x405da8
mov edi, dword [esi + 0x1c]
mov ebp, dword [esi + 0x24]
mov eax, dword [esi]
sub edi, 0x1337
add ebp, 0x7331
test eax, 0x40000000
je 0x405da8
mov eax, dword [esi]
and dword [esp + 0x10], 0
test eax, 0x10000
je 0x405d4d
push 0x42fcd0
push 1
mov ecx, 0x42fb70
call fcn.0040d9d1
mov ecx, eax
lea eax, [esp + 0x10]
push eax
push 0x40
mov eax, ebp
sub eax, edi
push eax
push edi
call dword [ecx]
push ebx
push 0xffffffffffffffff
mov eax, edi
sub eax, ebp
add eax, 0x738ad0c0
push eax
mov ecx, ebp
sub ecx, edi
mov dword [esp + 0x20], ecx
lea eax, [ecx + 0x667b00b5]
push eax
mov eax, dword [esi + 0x14]
sub eax, ebx
xor eax, 0xb16cbe31
push eax
push ecx
push edi
call fcn.00406489
mov eax, dword [esi]
add esp, 0x1c
test eax, 0x10000
je 0x405da8
push 0x42fcd0
push 1
mov ecx, 0x42fb70
call fcn.0040d9d1
lea ecx, [esp + 0x10]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x1c]
push edi
call dword [eax]
and dword [esi], 0x7fffffff
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
Function at 0x406131
Capabilities:
Get common file path

Disassembly:
sub esp, 0x438
push ebx
push ebp
mov ebp, dword [esp + 0x450]
or eax, 0xffffffff
push esi
mov esi, dword [esp + 0x450]
mov dword [esp + 0xc], eax
mov eax, ebp
lea ebx, [esi + 0x10]
and eax, 1
push edi
mov edi, ebx
mov dword [esp + 0x24], eax
je 0x4061a4
mov eax, dword [esp + 0x45c]
mov eax, dword [eax + 0xc]
test eax, 0xffff0000
je 0x4061a4
push 0x42fcd0
push 1
mov ecx, 0x42fb70
call fcn.0040d9d1
lea ecx, [esp + 0x10]
push ecx
movzx ecx, word [esi + 0xe]
push 4
shl ecx, 3
push ecx
push edi
call dword [eax]
mov ecx, dword [esp + 0x10]
test eax, eax
push 0xffffffffffffffff
pop eax
cmove ecx, eax
mov dword [esp + 0x10], ecx
and dword [esp + 0x1c], 0
xor eax, eax
cmp ax, word [esi + 0xe]
jae 0x40628f
mov ebx, dword [esp + 0x45c]
mov eax, ebp
and eax, 0x80
mov dword [esp + 0x20], eax
mov eax, ebp
and eax, 2
mov dword [esp + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 0xc]
shr ecx, 0x10
and edx, 0xffff
cmp dword [esp + 0x20], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
je 0x4061f6
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
call fcn.0040639e
cmp eax, 3
jae 0x406210
lea eax, [esp + 0x34]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.0040639e
cmp eax, 3
jae 0x40622d
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [esp + 0x30], 0
jne 0x406247
cmp dword [esp + 0x24], 0
je 0x4062e2
mov eax, dword [esp + 0x14]
cmp dword [edi], eax
jne 0x406274
push ebx
mov eax, ebp
or eax, 2
push eax
push edi
push dword [esp + 0x45c]
push dword [esp + 0x45c]
call fcn.00405fe4
or eax, 0xffffffff
add esp, 0x14
cmp dword [esp + 0x10], eax
je 0x406274
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov ecx, dword [esp + 0x1c]
movzx eax, word [esi + 0xe]
add edi, 8
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jb 0x4061d0
lea ebx, [esi + 0x10]
or eax, 0xffffffff
cmp dword [esp + 0x10], eax
je 0x4062d7
movzx eax, word [esi + 0xe]
mov byte [esp + 0x2c], 0
push dword [esp + 0x2c]
lea eax, [ebx + eax*8]
push eax
push ebx
call fcn.00404d3a
add esp, 0xc
mov ecx, 0x42fb70
push 0x42fcd0
push 1
call fcn.0040d9d1
lea ecx, [esp + 0x10]
push ecx
movzx ecx, word [esi + 0xe]
push dword [esp + 0x14]
shl ecx, 3
push ecx
push ebx
call dword [eax]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x438
ret
push ebx
push ebp
push edi
push dword [esp + 0x45c]
push dword [esp + 0x45c]
call fcn.00405fe4
add esp, 0x14
jmp 0x406274
Function at 0x4079ea
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push esi
push edi
mov edi, dword [esp + 0xc]
call fcn.004075ac
cmp eax, 3
jae 0x407a12
push str.721721
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x407a12
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
not ecx
jmp 0x407a46
movzx eax, byte [edi]
movzx edx, cl
xor edx, eax
push 8
dec esi
inc edi
pop eax
test dl, 1
je 0x407a3a
shr edx, 1
xor edx, 0xedb88320
jmp 0x407a3c
shr edx, 1
dec eax
test eax, eax
jg 0x407a2b
shr ecx, 8
xor ecx, edx
test esi, esi
jne 0x407a1e
not ecx
pop edi
mov eax, ecx
pop esi
ret

Function at 0x407a51
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ecx
mov eax, dword [0x4307f0]
or eax, dword [0x4307f4]
push esi
push edi
jne 0x407b37
push ebx
push ebp
xor ebx, ebx
mov eax, ebx
cdq
push 8
mov edi, eax
mov esi, edx
pop ebp
call fcn.004075ac
cmp eax, 3
jae 0x407a9b
push str.Local991
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x407a9b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
shrd edi, esi, 1
and eax, 1
shr esi, 1
or eax, 0
je 0x407ab7
xor edi, 0xd7870f42
xor esi, 0xc96c5795
dec ebp
jne 0x407a75
mov dword [ebx*8 + 0x42fff8], edi
mov dword [ebx*8 + 0x42fffc], esi
call fcn.004075ac
cmp eax, 3
jae 0x407aeb
push str.Local992
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x407aeb
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.004075ac
cmp eax, 3
jae 0x407b0b
push str.770770
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x407b0b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.004075ac
cmp eax, 3
jae 0x407b28
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc ebx
cmp ebx, 0x100
jl 0x407a6b
pop ebp
pop ebx
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ecx
not edx
test edi, edi
je 0x407b76
mov esi, dword [esp + 0x14]
test esi, esi
je 0x407b76
movzx eax, byte [edi]
xor eax, ecx
shrd ecx, edx, 8
and eax, 0xff
shr edx, 8
xor ecx, dword [eax*8 + 0x42fff8]
xor edx, dword [eax*8 + 0x42fffc]
inc edi
dec esi
jne 0x407b53
not ecx
pop edi
not edx
mov eax, ecx
pop esi
pop ecx
ret
Function at 0x409917
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
shr edi, 2
lea ebx, [eax + ecx*4]
mov ebp, 0xc0c0c0c0
test ecx, ecx
je 0x40997f
add esi, 0xb16b00b0
xor esi, ebp
dec ecx
jne 0x40993d
jmp 0x40997f
xor dword [ebx], esi
dec edi
lea ebx, [ebx + 4]
call fcn.00409d5c
cmp eax, 3
jae 0x409977
push str.Global552
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x409977
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
add esi, 0xb16b00b0
xor esi, ebp
test edi, edi
jne 0x40994a
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40a5d5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
call fcn.0040cb22
cmp eax, 3
jae 0x40a5fc
lea eax, [ebp - 0x460]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call fcn.0040cb22
cmp eax, 3
jae 0x40a62d
push str.Local1660
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40a62d
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], 0x40ac0d
mov dword [ebp - 0x20], 0x40a74a
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x30], esi
call fcn.0040a853
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x40b6d2
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0
push esi
jne 0x40b7ed
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40b80e
push edi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
call fcn.0040cb22
xor edi, edi
cmp eax, 3
jae 0x40b716
push str.Global113
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test esi, esi
jne 0x40b7cc
call fcn.0040c76d
mov esi, dword [ebp + 8]
sub eax, dword [esi + 0x10]
mov dword [esi + 0xc], eax
call fcn.0040cb22
cmp eax, 3
jae 0x40b752
push str.Global939
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40b752
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x42e660]
lea eax, [ecx + 0xa0]
push eax
push 1
call fcn.0040d9d1
cmp dword [eax], edi
je 0x40b787
mov ecx, dword [0x42e660]
lea eax, [ecx + 0xa0]
push eax
push 1
call fcn.0040d9d1
lea ecx, [esi + 0x18]
push ecx
push ebx
call dword [eax]
mov edi, eax
test edi, edi
jne 0x40b791
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x18]
push str.process_exit_code:__d
push esi
call fcn.0040cb40
mov eax, dword [esi]
add esp, 0xc
test byte [eax], 0x40
pop edi
je 0x40b80e
cmp dword [esi + 0x18], 0
je 0x40b80e
push dword [esi + 0x18]
lea ecx, [ebp - 0x10]
call fcn.0040a2f4
push 0x42b1d4
lea eax, [ebp - 0x10]
jmp 0x40b822
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
push eax
push str._ec_08x__wait_process_failed
push esi
call fcn.0040cb40
mov eax, dword [esi]
add esp, 0xc
test byte [eax], 0x20
je 0x40b791
jmp 0x40b812
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
push eax
push str._ec_08x__create_process_failed
push esi
call fcn.0040cb40
mov eax, dword [esi]
add esp, 0xc
test byte [eax], 0x20
je 0x40b80f
jmp 0x40b812
pop ebx
pop esi
leave
ret
lea ecx, [ebp - 0xc]
call fcn.00412bf7
push 0x42b1bc
lea eax, [ebp - 0xc]
push eax
call fcn.00412cee
int3
Function at 0x40c8c0
Capabilities:
Get common file path

Disassembly:
push 0x318
push 0x42b050
call fcn.00412d70
or dword [ebp - 0x1c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0040b829
pop ecx
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
jmp 0x40c8f7
cmp byte [0x4307fc], 0
je 0x40ca27
mov byte [ebp - 0x328], bl
mov esi, 0x103
push esi
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.00412430
add esp, 0xc
mov ecx, dword [0x42e660]
lea eax, [ecx + 0xb4]
push eax
push 1
call fcn.0040d9d1
cmp dword [eax], ebx
je 0x40c997
mov ecx, dword [0x42e660]
lea eax, [ecx + 0xbc]
push eax
push 1
call fcn.0040d9d1
cmp dword [eax], ebx
je 0x40c96b
mov ecx, dword [0x42e660]
lea eax, [ecx + 0xbc]
push eax
push 1
call fcn.0040d9d1
push ebx
call dword [eax]
mov esi, eax
jmp 0x40c96d
mov esi, ebx
mov ecx, dword [0x42e660]
lea eax, [ecx + 0xb4]
push eax
push 1
call fcn.0040d9d1
push 0x104
lea ecx, [ebp - 0x328]
push ecx
push esi
call dword [eax]
mov esi, 0x103
jmp 0x40c999
mov eax, ebx
test eax, eax
je 0x40ca27
mov byte [ebp - 0x120], bl
push esi
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.00412430
mov byte [ebp - 0x224], bl
push esi
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.00412430
add esp, 0x18
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40ca27
cmp eax, 0xf2
ja 0x40ca27
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x42e954
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40ca27
push 0x42e958
lea eax, [ebp - 0x224]
push eax
call fcn.00415640
lea eax, [ebp - 0x328]
push eax
call fcn.0040b157
add esp, 0xc
mov eax, dword [ebp - 0x1c]
call fcn.00412dab
ret

Function at 0x40ce79
Capabilities:
Terminate process

Disassembly:
mov eax, 0x420778
call fcn.00412d4c
push esi
mov esi, 0x40acac
push esi
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004150c5
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004063fb
add esp, 0x10
call fcn.0040cb22
xor esi, esi
cmp eax, 3
jae 0x40cedc
push str.Global635
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40cedc
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x484
call fcn.00401624
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x40cf00
push esi
push 0x2000003
mov ecx, eax
call fcn.004013c0
jmp 0x40cf02
mov eax, esi
or dword [ebp - 4], 0xffffffff
mov dword [0x42e660], eax
test eax, eax
jne 0x40cf21
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
push 0x424510
push dword [0x42e65c]
call fcn.00415730
pop ecx
pop ecx
test eax, eax
je 0x40cf3c
push 0xfffffffffffffffe
pop eax
jmp 0x40cf12
push dword [ebp + 0x10]
call fcn.0040c8c0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e4ec
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
push 0xc
push 0x42b7e0
call fcn.00412d70
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
push edx
push ecx
push ebx
mov eax, 0x564d5868
xor ebx, ebx
mov ecx, 0x14
mov edx, 0x5658
in eax, dx
cmp eax, 0x20
jl 0x40e529
cmp eax, 0x4000
jg 0x40e529
mov eax, 1
or dword [ebp - 0x1c], eax
pop ebx
pop ecx
pop edx
or dword [ebp - 4], 0xffffffff
jmp 0x40e53f
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
call fcn.004113ad
cmp eax, 3
jae 0x40e568
push str.Local1946
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40e568
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.004113ad
cmp eax, 3
jae 0x40e587
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40e587
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
xor eax, eax
xor ebx, ebx
inc eax
invalid

Function at 0x40ed3f
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push esi
mov esi, dword [0x430820]
jmp 0x40ed60
cmp dword [esi + 0x14], 0x10
jb 0x40ed54
mov eax, dword [esi]
jmp 0x40ed56
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esi, 0x18
cmp esi, dword [0x430824]
jne 0x40ed4a
pop esi
ret
Function at 0x41106a
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x420de0
call fcn.00412d4c
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0x10
jb 0x411086
mov eax, dword [esi]
jmp 0x411088
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x411123
push dword [0x42d1e0]
cmp dword [0x42d1e4], 0x10
mov eax, 0x42d1d0
cmovae eax, dword [0x42d1d0]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00410069
mov edi, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x4110fa
push ebx
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.004063bc
and dword [ebp - 4], 0
push edi
push eax
call fcn.0041106a
mov bl, al
pop ecx
neg bl
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004015cc
inc bl
pop ebx
je 0x4110fa
xor al, al
jmp 0x411132
cmp dword [esi + 0x14], 0x10
jb 0x411104
mov eax, dword [esi]
jmp 0x411106
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4110f6
push esi
mov ecx, 0x43080c
call fcn.00411173
mov byte [edi], 0
jmp 0x411130
test eax, 0x410
je 0x4110f6
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4111d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x420dc4
call fcn.00412d4c
mov eax, 0x1044
call fcn.004155e0
push ebp
push esi
xor ecx, ecx
push edi
mov dword [esp + 0x1058], ecx
mov dword [esp + 0x20], ecx
call fcn.004113ad
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ebp, ebp
inc ebp
cmp eax, 3
jae 0x411226
push str.Local1909
push ebp
push ebp
push ecx
call edi
test eax, eax
je 0x411224
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
call fcn.004113ad
cmp eax, 3
jae 0x411241
push ecx
push ecx
push ecx
push ecx
call edi
test eax, eax
je 0x411241
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push dword [esp + 0x1078]
push dword [esp + 0x1078]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [esp + 0x1064]
xor ecx, ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ecx
mov byte [esi], cl
mov dword [esp + 0x1058], ecx
mov dword [esp + 0x20], ebp
test eax, eax
jne 0x41137f
call fcn.004113ad
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 3
jae 0x4112a6
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ecx
call ebp
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
push dword [esp + 0x1080]
mov dword [esp + 0x20], 0x1000
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x24], eax
call fcn.004113ad
cmp eax, 3
jae 0x4112ec
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call ebp
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov byte [esp + eax + 0x4c], cl
cmp dword [esp + 0x24], ecx
jne 0x411375
call fcn.004113ad
cmp eax, 3
jae 0x411319
push ecx
push ecx
push ecx
push ecx
call edi
test eax, eax
je 0x411317
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 2
ja 0x411394
push dword [esp + 0xc]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
lea eax, [esp + 0x50]
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2c], cl
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0xf
call fcn.004040e9
mov dword [esp + 0x1058], 1
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.00409784
mov byte [esp + 0x1058], 0
lea ecx, [esp + 0x28]
call fcn.004015cc
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1050]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
leave
ret
lea ecx, [esp + 0x40]
call fcn.00412bf7
push 0x42b1bc
lea eax, [esp + 0x44]
push eax
call fcn.00412cee
int3
Function at 0x411459
Capabilities:
Delete directory

Disassembly:
mov eax, 0x420de0
call fcn.00412d4c
sub esp, 0x18
cmp dword [0x43081c], 0
je 0x4114b8
push esi
mov esi, 0x43080c
mov ecx, esi
call fcn.0040ecd6
push eax
lea ecx, [ebp - 0x24]
call fcn.0040a246
and dword [ebp - 4], 0
mov ecx, esi
call fcn.00411140
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004015cc
cmp dword [0x43081c], 0
jne 0x411475
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret