joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011610
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x10024f58
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x10011637
add eax, 8
inc ecx
cmp eax, 0x10024fe8
jb 0x10011628
cmp dword [ecx*8 + 0x10024f58], edx
lea ebx, [ecx*8]
jne 0x100117fb
cmp dword [0x10023bbc], 1
je 0x100117b7
cmp dword [0x10023bbc], 0
jne 0x1001166e
cmp dword [0x10023bc0], 1
je 0x100117b7
cmp edx, 0xfc
je 0x100117fb
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x100116ab
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x100116ef
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x10018b38
push ebp
call fcn.1000b2c0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10018b18
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x10024f5c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.10013e40
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x100285f0], 0
je 0x100117cd
mov eax, dword [0x100285f0]
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x100117d7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x10024f5c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x10012ac0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], edi
cmp ebp, edi
jne 0x10012ae8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov edx, dword [esp + 0x42c]
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x100285f0
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ebx, dword [esp + 0x18]
shl eax, 2
lea ecx, [eax + eax*8]
mov eax, dword [ebx]
mov dword [esp + 0x1c], ecx
test byte [eax + ecx + 4], 0x20
je 0x10012b29
push 2
push 0
push edx
call fcn.10010c60
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x10012bc5
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x10012bfe
lea esi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x10012b8c
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x10012b7a
mov byte [esi], 0xd
inc edi
inc esi
mov byte [esi], al
inc esi
mov eax, esi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x10012b61
lea eax, [esp + 0x24]
push 0
sub esi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10012bf4
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, esi
jge 0x10012b4c
jmp 0x10012bfe
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10012bf4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x10012bfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x10012caa
cmp dword [esp + 0x10], 0
je 0x10012c5a
cmp dword [esp + 0x10], 5
jne 0x10012c3d
call fcn.10010bc0
mov dword [eax], 9
call fcn.10010bd0
mov ecx, dword [esp + 0x10]
pop ebp
pop edi
mov dword [eax], ecx
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10010b40
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x10012c84
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x10012c84
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
call fcn.10010bc0
mov dword [eax], 0x1c
call fcn.10010bd0
pop ebp
mov dword [eax], 0
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, edi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x10016f70
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x10025d18]
push esi
test eax, eax
push edi
push ebp
jne 0x10016fb8
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 1
push 0
call esi
test eax, eax
je 0x10016f98
mov eax, 2
jmp 0x10016fbe
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10016fb1
mov eax, 1
jmp 0x10016fbe
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [0x10025d18], eax
cmp eax, 2
jne 0x10016fe3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x10025d18], eax
cmp eax, 1
jne 0x1001707f
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x10016fff
mov edi, dword [0x100251a8]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebp, eax
test ebp, ebp
jne 0x10017020
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
lea eax, [ebp*2]
push eax
call fcn.1000a6d0
add esp, 4
mov esi, eax
test esi, esi
jne 0x1001703d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10017074
mov eax, dword [esp + 0x20]
push 0
push 0
test eax, eax
jne 0x10017084
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x1001709f
push esi
call fcn.1000a5f0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x28]
push eax
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x10017074
push esi
call fcn.1000a5f0
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4010bc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x104]
xor al, al
stosb byte es:[edi], al
mov ecx, 0x2a
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3e
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3f
stosb byte es:[edi], al
mov ecx, 0xa
mov al, 0x34
stosb byte es:[edi], al
inc al
loop 0x4010f2
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
xor al, al
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
xor al, al
stosb byte es:[edi], al
inc al
loop 0x401113
mov dl, al
mov ecx, 6
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
mov al, dl
stosb byte es:[edi], al
inc al
loop 0x40112a
mov ecx, 0x85
mov al, 0xff
rep stosb byte es:[edi], al
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, edi
mov al, byte [edi]
add edi, 4
test al, al
jne 0x40113f
lea ebx, [edi - 4]
mov eax, 0x3d
sub ebx, esi
je 0x4011d1
cmp al, byte [esi + ebx - 1]
sete dl
jne 0x401161
mov byte [esi + ebx - 1], ah
cmp al, byte [esi + ebx - 2]
sete al
jne 0x40116e
mov byte [esi + ebx - 2], ah
add al, dl
mov edi, dword [ebp + 0xc]
shr ebx, 2
lea edx, [ebx + ebx*2]
sub edx, eax
push edx
mov dword [ebp - 4], ebx
mov ecx, dword [esi]
movzx edx, cl
movzx ebx, ch
push edi
lea edi, [ebp - 0x104]
mov al, byte [edx + edi]
mov ah, byte [ebx + edi]
shr ecx, 0x10
add esi, 4
movzx edx, cl
movzx ecx, ch
mov bl, byte [edx + edi]
mov bh, byte [ecx + edi]
pop edi
mov dl, ah
mov dh, bl
shl al, 2
shr bl, 2
shl dh, 6
shl ah, 4
shr dl, 4
or bh, dh
or al, dl
or ah, bl
mov byte [edi], al
mov byte [edi + 2], bh
mov byte [edi + 1], ah
dec dword [ebp - 4]
lea edi, [edi + 3]
jne 0x40117f
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4011dc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x44]
mov eax, 0x44434241
stosd dword es:[edi], eax
mov eax, 0x48474645
stosd dword es:[edi], eax
mov eax, 0x4c4b4a49
stosd dword es:[edi], eax
mov eax, 0x504f4e4d
stosd dword es:[edi], eax
mov eax, 0x54535251
stosd dword es:[edi], eax
mov eax, 0x58575655
stosd dword es:[edi], eax
mov eax, 0x62615a59
stosd dword es:[edi], eax
mov eax, 0x66656463
stosd dword es:[edi], eax
mov eax, 0x6a696867
stosd dword es:[edi], eax
mov eax, 0x6e6d6c6b
stosd dword es:[edi], eax
mov eax, 0x7271706f
stosd dword es:[edi], eax
mov eax, 0x76757473
stosd dword es:[edi], eax
mov eax, 0x7a797877
stosd dword es:[edi], eax
mov eax, 0x33323130
stosd dword es:[edi], eax
mov eax, 0x37363534
stosd dword es:[edi], eax
mov eax, 0x2f2b3938
stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 4], 0
jne 0x40125e
jmp 0x4012b9
mov al, byte [esi]
mov dl, byte [esi + 1]
mov bl, byte [esi + 2]
mov ah, al
mov dh, dl
mov bh, bl
and ah, 3
and dh, 0xf
and bh, 0x3f
shr al, 2
shr dl, 4
shr bl, 6
shl ah, 4
shl dh, 2
or ah, dl
or bl, dh
movzx edx, al
movzx ecx, ah
push esi
lea esi, [ebp - 0x44]
mov al, byte [edx + esi]
mov ah, byte [ecx + esi]
movzx edx, bl
movzx ecx, bh
mov bl, byte [edx + esi]
mov bh, byte [ecx + esi]
pop esi
and eax, 0xffff
shl ebx, 0x10
add esi, 3
or eax, ebx
stosd dword es:[edi], eax
sub dword [ebp - 4], 3
jns 0x401256
cmp dword [ebp - 4], 0
je 0x4012cb
add edi, dword [ebp - 4]
mov byte [edi], 0x3d
inc edi
inc dword [ebp - 4]
jne 0x4012c2
mov eax, edi
mov word [eax], 0
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4012e0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 4], 0
push 0
push 0x28
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.SHELL32.dll_SHGetSpecialFolderPathW
push str.NTUSER.DAT
lea eax, [ebp - 0x20c]
push eax
call sub.SHLWAPI.dll_PathAppendW
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x40132b
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401488
Capabilities:
Check os version
Get number of processors

Disassembly:
push esi
push edi
mov eax, dword fs:[0x30]
mov esi, dword [eax + 0xa4]
mov edi, dword [eax + 0xa8]
cmp esi, 5
jne 0x4014a6
cmp edi, 1
jb 0x4014ab
cmp esi, 5
jae 0x4014b8
mov eax, 0
pop edi
pop esi
ret
cmp esi, 5
jne 0x4014cf
cmp edi, 1
jne 0x4014cf
mov eax, 0x33
pop edi
pop esi
ret
cmp esi, 5
jne 0x4014e3
cmp edi, 2
jne 0x4014e3
mov eax, 0x34
pop edi
pop esi
ret
cmp esi, 6
jne 0x4014f6
test edi, edi
jne 0x4014f6
mov eax, 0x3c
pop edi
pop esi
ret
cmp esi, 6
jne 0x40150a
cmp edi, 1
jne 0x40150a
mov eax, 0x3d
pop edi
pop esi
ret
cmp esi, 6
jne 0x40151e
cmp edi, 2
jne 0x40151e
mov eax, 0x3e
pop edi
pop esi
ret
cmp esi, 6
jne 0x401532
cmp edi, 3
jne 0x401532
mov eax, 0x3f
pop edi
pop esi
ret
cmp esi, 0xa
jne 0x401545
test edi, edi
jne 0x401545
mov eax, 0x64
pop edi
pop esi
ret
cmp esi, 0xa
jne 0x40154f
cmp edi, 0
ja 0x401554
cmp esi, 0xa
jbe 0x40155c
mov eax, 0x7fffffff
pop edi
pop esi
ret
mov eax, 0xffffffff
pop edi
pop esi
ret
Function at 0x401ed0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [edi], eax
mov dword [edi + 4], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], edx
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], edx
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], edx
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], edx
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], edx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], edx
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], edx
pop edi
pop esi
pop ebp
ret 8

Function at 0x402240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
cmp dword [ebp + 8], 0xffffffff
je 0x4022e9
cmp dword [ebp + 0x10], 0
je 0x4022e9
cmp dword [ebp + 0x14], 0
je 0x40227c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push str.true_s_s_n
push 0x407710
call sub.msvcrt.dll_swprintf
add esp, 0x10
mov ecx, eax
jmp 0x4022c6
cmp dword [ebp + 0xc], 0
jne 0x402289
mov eax, str.file_empty
jmp 0x4022ae
cmp dword [ebp + 0xc], 1
jne 0x402296
mov eax, str.file_not_found
jmp 0x4022ae
cmp dword [ebp + 0xc], 2
jne 0x4022a3
mov eax, str.file_not_encrypted_or_damaged
jmp 0x4022ae
cmp dword [ebp + 0xc], 3
jne 0x4022ae
mov eax, str.file_rsa_key_not_valid
push eax
push dword [ebp + 0x10]
push str.false_s_s_n
push 0x407710
call sub.msvcrt.dll_swprintf
add esp, 0x10
mov ecx, eax
push 0x407710
push 0x407710
call fcn.00401094
push 0
lea eax, [ebp - 4]
push eax
push ecx
push 0x407710
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402460
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push ecx
push edx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x400
push dword [ebp - 8]
call fcn.00401fb8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x40249d
jmp 0x4024cc
cmp eax, 0xc0000004
jne 0x4024b6
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00401fd4
mov dword [ebp - 0xc], eax
jmp 0x402484
push dword [ebp - 0xc]
call fcn.00401ff4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebx]
cmp dword [ebx + 0x3c], 0
je 0x4024f0
push 0
push dword [ebx + 0x3c]
call fcn.0040103c
cmp eax, 0x3eb272e6
jne 0x4024f0
mov eax, dword [ebx + 0x44]
mov dword [ebp - 4], eax
jmp 0x4024f7
lea ebx, [ebx + esi]
test esi, esi
jne 0x4024cf
push dword [ebp - 0xc]
call fcn.00401ff4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402810
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], 0
push dword [ebp + 8]
call sub.SHLWAPI.dll_PathFindFileNameW
push 0xffffffffffffffff
push eax
call fcn.0040103c
cmp eax, dword [0x407700]
jne 0x40284d
push pe_nt_image_headers32
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [ebp + 8]
call sub.KERNEL32.dll_DeleteFileW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402900
Capabilities:
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push ecx
push edx
push esi
push edi
mov dword [ebp - 0x10], 0
call fcn.00402688
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402b32
push 0
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
call sub.SHELL32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x218]
push eax
call fcn.00401574
mov ebx, dword [ebp - 0x10]
lea eax, [ebx + 2]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
push str..bmp
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
lea eax, [ebp - 0x218]
push eax
call sub.KERNEL32.dll_DeleteFileW
lea eax, [ebp - 0x218]
push eax
call sub.SHLWAPI.dll_PathFindExtensionW
push str..ico
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
lea eax, [ebp - 0x218]
push eax
call sub.KERNEL32.dll_DeleteFileW
lea eax, [ebx + 2]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
push str.DefaultIcon
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
push str.advapi32.dll
call sub.KERNEL32.dll_GetModuleHandleW
push str.RegDeleteKeyExW
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x407f10], eax
cmp dword [0x407f10], 0
je 0x402a2f
push 0
push 0x100
lea eax, [ebp - 0x218]
push eax
push 0x80000000
call dword [0x407f10]
push 0
push 0x100
lea eax, [ebx + 2]
push eax
push 0x80000000
call dword [0x407f10]
push 0
push 0x100
push ebx
push 0x80000000
call dword [0x407f10]
jmp 0x402a59
lea eax, [ebp - 0x218]
push eax
push 0x80000000
call sub.AdvAPI32.dll_RegDeleteKeyW
lea eax, [ebx + 2]
push eax
push 0x80000000
call sub.AdvAPI32.dll_RegDeleteKeyW
push ebx
push 0x80000000
call sub.AdvAPI32.dll_RegDeleteKeyW
lea eax, [ebp - 0x218]
push eax
push dword [0x408084]
call fcn.00402858
lea eax, [ebp - 0x218]
push eax
call fcn.00401574
push str.Control_PanelDesktop
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20106
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0x80000003
call sub.AdvAPI32.dll_RegCreateKeyExW
test eax, eax
jne 0x402acf
push 0
push 0
push 1
push 0
push str.WallPaper
push dword [ebp - 4]
call sub.AdvAPI32.dll_RegSetValueExW
cmp dword [ebp - 4], 0
je 0x402add
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov dword [ebp - 8], 1
xor eax, eax
mov ah, 0xa5
mov al, 0x6e
rol eax, 8
mov al, 0x3a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
call sub.USER32.dll_SetSysColors
mov ebx, 2
call fcn.00401488
cmp eax, 0x34
je 0x402b13
or ebx, 1
push ebx
push 0
push 0
push 0x14
call sub.USER32.dll_SystemParametersInfoW
push 0
push 0
push 0x1000
push 0x8000000
call sub.SHELL32.dll_SHChangeNotify
cmp dword [ebp - 0x10], 0
je 0x402b40
push dword [ebp - 0x10]
call fcn.00401ff4
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402c38
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x402c1c
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402cd9
cmp dword [ebp + 8], 0
je 0x402cb3
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402b9c
test eax, eax
jne 0x402cb3
push 0
push dword [ebp - 4]
call sub.ntdll.dll_NtTerminateThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp - 4]
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GetExitCodeThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x402cf8
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push ecx
push edx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 4
lea eax, [ebp - 0x10]
push eax
push 0x402ce4
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402d97
cmp dword [ebp + 8], 0
je 0x402d71
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402b9c
test eax, eax
jne 0x402d71
push 0
push dword [ebp - 4]
call sub.ntdll.dll_NtTerminateThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp - 4]
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GetExitCodeThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc