joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52d0a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd6000]
push edi
jmp 0x52d0ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52d0c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d0b0
mov eax, 1
add ebx, ebx
jne 0x52d0d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52d0e4
jne 0x52d103
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d103
dec eax
add ebx, ebx
jne 0x52d0f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52d0c8
add ebx, ebx
jne 0x52d0ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52d155
xor ecx, ecx
sub eax, 3
jb 0x52d11b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52d18a
sar eax, 1
mov ebp, eax
jmp 0x52d126
add ebx, ebx
jne 0x52d126
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d0f4
inc ecx
add ebx, ebx
jne 0x52d134
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d0f4
add ebx, ebx
jne 0x52d141
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52d136
jne 0x52d152
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52d136
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52d174
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52d166
jmp 0x52d0b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52d174
add edi, ecx
jmp 0x52d0b6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52d192
cmp byte [edi], 0x11
jne 0x52d192
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52d197
lea edi, [esi + 0x126000]
mov eax, dword [edi]
or eax, eax
je 0x52d20f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x181630]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1817ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52d1c4
mov ecx, edi
jns 0x52d1f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1817b0]
or eax, eax
je 0x52d209
mov dword [ebx], eax
add ebx, 4
jmp 0x52d1e1
call dword [esi + 0x1817c0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52d240
cmp al, 0xef
ja 0x52d233
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52d215
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52d222
mov ebp, dword [esi + 0x1817b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52d274
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x8e0dbc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e0dc2
pop ebp
sub ebp, 6
sub ebp, 0x4e0dbc
jmp 0x8e0e20
jmp 0x8e0e29
mov eax, 0x4e0dbc
add eax, ebp
add eax, 0x93
mov ecx, 0x637
mov edx, 0x87955a13
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e0e40
invalid
jmp 0x8e0e53
jns 0x8e0ea8
jnp 0x8e0e6a
add edx, dword [ebx]
adc edi, dword [ebx + 0x13]
fistp qword [edi]
adc edx, dword [edx - 0xed1201d]
outsd dx, dword [esi]
xchg edx, eax
jecxz 0x8e0e47
int1
outsd dx, dword [esi]
and bl, dl
inc ebx
in al, dx
xchg byte [edi], ch
inc edx
push edi
adc eax, dword [ebx - 0x68]
ficomp word [eax + 0x13132f9a]
adc edx, dword [edx + 0x1313ebd2]
adc edx, dword [eax]
fisubr word [ebx + 0x13131315]
test eax, 0x1313133b
in al, 0xf1
adc bl, bl
cwde
xchg edx, eax
pop ds
adc edx, dword [ebx]
adc edx, dword [eax]
salc
inc ebx
jnp 0x8e0ef0
and byte [edx], bl
adc edi, dword [ebx + 0x68]
leave
push edi
adc edx, dword [edx]
aas
aaa
jnp 0x8e0ebe
adc edx, dword [ebx]
adc edi, ebx
push ss
adc edx, dword [ebx]
adc edi, edx
cmp edx, dword [ebx]
adc edx, dword [ebx]
inc esi
inc edi
dec esi
cwde
xchg esi, eax
sbb edx, dword [ebx]
adc edx, dword [ebx]
cwde
xchg byte [edi], bl
adc edx, dword [ebx]
adc edx, dword [ebx]
adc ebx, dword [eax + 0x13131f86]
adc ebx, dword [eax + 0x1313039e]
adc edx, edx
cli
adc dword [edx], esp
adc dword [eax + 0x1c5a17d1], edx
xchg esi, eax
out 0xec, eax
in al, dx
in al, dx
dec esi
rcr dword [edi], 1
adc ebx, dword [eax + 0x1317379f]
adc edx, dword [ebx]
jnp 0x8e0f3b
and byte [edx], bl
adc edi, dword [ebx + 0x68]
leave
push edi
adc edx, dword [edx]
aas
aaa
inc edx
sti
push ss
adc edx, dword [ebx]
adc edi, edx
push edx
adc dword [ebx], edx
adc eax, dword [esi - 0x62]
jg 0x8e0f3a
adc ebp, esp
pop ds
in al, dx
sbb di, bx
popal
adc edx, dword [ebx]
adc ebx, dword [eax + 0x13131bae]
adc edx, dword [edx - 0x1dc7431e]
cwde
xchg edx, eax
loop 0x8e0eda
cmp dl, ah
cwde
and dl, bl
and cl, al
nop
sti
push ss
pop ebx
sbb al, 0x97
pop ebp
adc edx, dword [ebx]
adc ebx, dword [ebx + ebx*4]
pop ebx
adc edx, dword [ebx]
adc esi, dword [ebp - 0x68]
cvtpi2ps xmm2, qword [ebx - 0x68e30418]
call 0xa252c3a
adc edx, dword [ebx]
adc edx, dword [ebx - 0x68e30518]
add dl, byte [ebx]
adc edx, dword [ebx]
jne 0x8e0edf
sti
sbb al, 0x97
or dword [ebx], edx
adc edx, dword [ebx]
xchg ebx, eax
call 0x3252c42
adc edx, dword [ebx]
adc esi, dword [ebp - 0x6e]
call 0x97aa463e
push es
adc edx, dword [ebx]
adc edx, dword [edx - 6]
fucompi st(4)
in al, dx
in al, dx
cmp bl, byte [edi + 0x2a]
adc dl, byte [eax - 0x46fe92e]
pop ss
cli
scasb al, byte es:[edi]
in al, dx
in al, dx
in al, dx
cmp al, byte [edi + 0x2a]
adc dword [eax - 0x66fea2e], edx
pop ss
nop
sti
push ss
cli
mov eax, 0x4eececec
rcr dword [edi], 1
adc eax, dword [esi - 0x68]
inc dword [ebp + 0x44]
inc esi
cwde
pop ds
cwde
outsb dx, byte [esi]
sbb ebp, edi
mov eax, dword [0x92159993]
aad 0x12
adc edx, dword [ebx]
adc ebx, dword [ebx + 0x12d49214]
adc edx, dword [ebx]
adc ebp, dword [eax + 0x13131311]
adc ecx, eax
sbb al, 0x96
push ss
adc edx, dword [ebx]
adc ebx, dword [ecx - 0x3efeaafb]
sbb al, 0x90
retf
Function at 0x7003301
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x7003310
pop dword [ebp - 0x14]
mov eax, 0x7003310
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x8d79abe0
add dword [ebp - 0x24], 0xc0d8996b
mov dword [ebp - 0x20], 0x1a37b46f
add dword [ebp - 0x20], 0x17fb97d6
mov dword [ebp - 0x1c], 0xd2cb6472
sub dword [ebp - 0x1c], 0x867f2044
mov dword [ebp - 0x18], 0xaf9aa6b3
sub dword [ebp - 0x18], 0xaf9aa6b3
lea eax, [ebp - 0x24]
push eax
mov eax, 0x1acd7d1e
add eax, 0xec33a312
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xded2db2
sub dword [ebp - 0x24], 0x997ac45c
mov dword [ebp - 0x20], 0xfc44294b
add dword [ebp - 0x20], 0x4528382a
mov dword [ebp - 0x1c], 0xb4a6118c
sub dword [ebp - 0x1c], 0x5136a520
mov dword [ebp - 0x18], 0xac9edb15
sub dword [ebp - 0x18], 0xac9edb15
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xb73549a0
sub eax, 0xb034296c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3ce0f
push 0
call eax
mov ecx, 0xde9b3f2e
sub ecx, 0xde9aee23
mov edx, eax
mov ebx, 0x27bd818b
sub ebx, 0x20bba18b
add ebx, dword [ebp - 0x14]
mov esi, 0x1e519a63
sub esi, 0xcbdfa289
add dword [ebp - 0xc], 0x972fb6f9
mov edi, dword [ebx]
xor dword [ebp - 8], 0xf6acb2d3
sub edi, esi
xor dword [ebp - 0xc], ecx
mov dword [edx], edi
add edx, 0x8654e24f
sub edx, 0x8654e24b
add ebx, 4
loop 0x700342d
add eax, 0x50337cc1
sub eax, 0x503245c2
mov ebx, eax
add eax, 0xd7aac87f
sub eax, 0xd7aac87a
mov ecx, 0x166130b2
add ecx, 0xf09ecf4e
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003301
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003301
int3
Function at 0x4253f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e36f
and dword [ebp - 4], 0
cmp dword [0x4506b0], 0
mov ebx, eax
jne 0x4254a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425557
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425557
push eax
call fcn.0041e2fd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4506b0], eax
call esi
push eax
call fcn.0041e2fd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4506b4], eax
call esi
push eax
call fcn.0041e2fd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4506b8], eax
call esi
push eax
call fcn.0041e2fd
pop ecx
mov dword [0x4506c0], eax
test eax, eax
je 0x4254a6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e2fd
pop ecx
mov dword [0x4506bc], eax
mov eax, dword [0x4506bc]
cmp eax, ebx
je 0x4254fe
cmp dword [0x4506c0], ebx
je 0x4254fe
push eax
call fcn.0041e378
push dword [0x4506c0]
mov esi, eax
call fcn.0041e378
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4254fe
test edi, edi
je 0x4254fe
call esi
test eax, eax
je 0x4254f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4254f5
test byte [ebp - 0xc], 1
jne 0x4254fe
or dword [ebp + 0x10], 0x200000
jmp 0x425537
mov eax, dword [0x4506b4]
cmp eax, ebx
je 0x425537
push eax
call fcn.0041e378
pop ecx
test eax, eax
je 0x425537
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425537
mov eax, dword [0x4506b8]
cmp eax, ebx
je 0x425537
push eax
call fcn.0041e378
pop ecx
test eax, eax
je 0x425537
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4506b0]
call fcn.0041e378
pop ecx
test eax, eax
je 0x425557
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425559
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x69721821
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x2f1f732e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 1
mov edx, eax
mov dword [ebp - 4], edx
jle 0x4010f3
push edi
mov edi, 1
jbe 0x4010f2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str._path
push dword [edx + edi*4]
call esi
test eax, eax
mov eax, dword [ebp - 4]
jne 0x4010a6
mov eax, dword [eax + edi*4 + 4]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax*2 + 2]
push esi
push 8
push dword [0x422334]
call ebx
test eax, eax
jne 0x40108f
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x422334]
call ebx
test eax, eax
je 0x401075
push dword [ebp - 0xc]
mov dword [0x422308], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x4010e3
push str._nomutex
push dword [eax + edi*4]
call esi
test eax, eax
jne 0x4010c0
mov dword [0x422300], 1
jmp 0x4010e3
mov eax, dword [ebp - 4]
push str._nonetdrive
push dword [eax + edi*4]
call esi
mov ecx, dword [0x422304]
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [0x422304], ecx
mov edx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp - 8]
jb 0x401040
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
push edi
mov edi, edx
mov dword [ebp - 4], edi
test ecx, ecx
je 0x40166d
mov eax, dword [esi + 0x80]
push ebx
mov ebx, dword [ebp + 8]
cmp eax, 0x40
jae 0x4015a0
nop dword [eax]
mov al, byte [eax + esi + 0x40]
xor al, byte [edi]
inc edi
mov byte [ebx], al
inc ebx
mov eax, dword [esi + 0x80]
inc eax
mov dword [ebp - 8], ebx
sub ecx, 1
mov dword [esi + 0x80], eax
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], ecx
je 0x40166c
cmp eax, 0x40
jb 0x401570
jmp 0x4015a3
mov dword [ebp - 8], ebx
lea eax, [esi + 0x40]
mov dword [ebp - 0x14], eax
nop dword [eax]
push 8
mov edx, esi
mov ecx, eax
call fcn.004012a0
add esp, 4
add dword [esi + 0x30], 1
jne 0x4015c7
inc dword [esi + 0x34]
mov edx, dword [ebp + 0xc]
cmp edx, 0x40
jbe 0x401648
mov ecx, dword [ebp - 4]
lea eax, [ebx + 1]
add edi, 3
lea edx, [esi + 0x41]
sub ecx, ebx
mov esi, 0x10
mov dword [ebp - 0x10], ecx
mov ebx, ecx
nop word [eax + eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor cl, byte [edi - 3]
lea edi, [edi + 4]
mov byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [ebx + eax - 4]
xor cl, byte [edx - 4]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor cl, byte [edi - 5]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor cl, byte [edi - 4]
mov byte [eax - 2], cl
sub esi, 1
jne 0x4015f0
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
add edi, 0x40
mov esi, dword [ebp - 0xc]
add ebx, 0x40
sub dword [ebp + 0xc], 0x40
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
lea eax, [esi + 0x40]
jmp 0x4015b0
test edx, edx
je 0x401666
sub edi, ebx
xor esi, esi
mov eax, dword [ebp - 0x14]
lea ecx, [esi + ebx]
mov al, byte [eax + esi]
inc esi
xor al, byte [edi + ecx]
mov byte [ecx], al
cmp esi, edx
jb 0x401650
mov esi, dword [ebp - 0xc]
mov dword [esi + 0x80], edx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404a80
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
cmp dword [0x422300], 0
jne 0x404ab2
push str.GlobalSergeyMutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x422324], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404ab2
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x404af0
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push str._c_SCHTASKS.exe__Delete__TN__Windows_Update_BETA___F
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x404b30
Capabilities:
Change the wallpaper
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push 3
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0xd4860e
push eax
push 1
call dword [sym.imp.USER32.dll_SetSysColors]
lea eax, [ebp - 8]
push eax
push 0x20106
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404be6
push 0x41f330
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push 0x41f330
push 1
push 0
push str.LegalNoticeCaption
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x41f330
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push 0x41f330
push 1
push 0
push str.LegalNoticeText
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x405a20
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov ecx, 0x20
test al, 0x20
cmovne eax, ecx
mov dword [ebp - 0x10], eax
lea ebx, [eax + eax]
push ebx
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x42232c], eax
test eax, eax
je 0x405ba4
push esi
push edi
push 0x80000001
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea esi, [ebx*4]
push esi
push 8
push dword [0x422334]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x405ab0
nop word [eax + eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x422334]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x405a90
xor esi, esi
test ebx, ebx
je 0x405ad3
push 0
push 0
push 0
push 0x405650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + esi*4], eax
inc esi
cmp esi, ebx
jb 0x405ab6
push ebx
push str._lu_I_O_Workers_Created
call fcn.00404950
mov eax, dword [0x422308]
add esp, 8
test eax, eax
je 0x405af2
push eax
call fcn.00404fd0
jmp 0x405af7
call fcn.004053a0
push str.Waiting_For_I_O_Workers
call fcn.00404950
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
nop word [eax + eax]
push 0x300
call esi
mov eax, dword [0x422328]
cmp dword [0x422330], eax
jne 0x405b10
test ebx, ebx
je 0x405b63
mov esi, ebx
nop word [eax + eax]
push 0
push 0
push 0
push dword [0x42232c]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub esi, 1
jne 0x405b30
push 0xffffffffffffffff
push 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [edi + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jb 0x405b53
jmp 0x405b6f
push 0xffffffffffffffff
push 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push edi
push 0
push dword [0x422334]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [0x42232c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Decryption_Completed
call fcn.00404950
add esp, 4
push 0x80000000
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405f50
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x74], 0x6a09e667
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0xbb67ae85
mov edx, ecx
movlpd qword [ebp - 0x7c], xmm0
push 0x20
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0x3c6ef372
mov dword [ebp - 0x68], 0xa54ff53a
mov dword [ebp - 0x64], 0x510e527f
mov dword [ebp - 0x60], 0x9b05688c
mov dword [ebp - 0x5c], 0x1f83d9ab
mov dword [ebp - 0x58], 0x5be0cd19
mov dword [ebp - 0x54], 0
call fcn.00405ed0
mov eax, dword [ebp - 0x7c]
mov edi, 0x78
mov edx, dword [ebp - 0x78]
mov esi, eax
sub edi, dword [ebp - 0x54]
xor ecx, ecx
rol eax, 8
add esp, 4
and eax, 0xff00ff
ror esi, 8
and esi, 0xff00ff00
or esi, eax
mov eax, edx
ror eax, 8
rol edx, 8
and eax, 0xff00ff00
and edx, 0xff00ff
mov dword [ebp - 8], esi
or eax, edx
mov edx, 0x41f220
or ecx, eax
cmp edi, 0x40
lea eax, [edi - 0x40]
mov dword [ebp - 0xc], ecx
cmovbe eax, edi
lea ecx, [ebp - 0x7c]
push eax
call fcn.00405ed0
add esp, 4
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x7c]
push 8
call fcn.00405ed0
add esp, 4
test ebx, ebx
je 0x406127
mov ecx, dword [ebp - 0x74]
mov eax, ecx
shr eax, 0x18
mov byte [ebx], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 1], al
movzx eax, byte [ebp - 0x74]
mov byte [ebx + 3], al
shr ecx, 8
mov byte [ebx + 2], cl
mov ecx, dword [ebp - 0x70]
mov eax, ecx
shr eax, 0x18
mov byte [ebx + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 5], al
movzx eax, byte [ebp - 0x70]
mov byte [ebx + 7], al
shr ecx, 8
mov byte [ebx + 6], cl
mov ecx, dword [ebp - 0x6c]
mov eax, ecx
shr eax, 0x18
mov byte [ebx + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 9], al
movzx eax, byte [ebp - 0x6c]
mov byte [ebx + 0xb], al
shr ecx, 8
mov byte [ebx + 0xa], cl
mov ecx, dword [ebp - 0x68]
mov eax, ecx
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0xd], al
movzx eax, byte [ebp - 0x68]
mov byte [ebx + 0xf], al
shr ecx, 8
mov byte [ebx + 0xe], cl
mov ecx, dword [ebp - 0x64]
mov eax, ecx
shr eax, 0x18
mov byte [ebx + 0x10], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0x11], al
movzx eax, byte [ebp - 0x64]
mov byte [ebx + 0x13], al
shr ecx, 8
mov byte [ebx + 0x12], cl
mov ecx, dword [ebp - 0x60]
mov eax, ecx
shr eax, 0x18
mov byte [ebx + 0x14], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0x15], al
movzx eax, byte [ebp - 0x60]
shr ecx, 8
mov byte [ebx + 0x17], al
mov byte [ebx + 0x16], cl
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
shr eax, 0x18
mov byte [ebx + 0x18], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0x19], al
movzx eax, byte [ebp - 0x5c]
shr ecx, 8
mov byte [ebx + 0x1a], cl
mov ecx, dword [ebp - 0x58]
mov byte [ebx + 0x1b], al
mov eax, ecx
shr eax, 0x18
mov byte [ebx + 0x1c], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0x1d], al
movzx eax, byte [ebp - 0x58]
shr ecx, 8
mov byte [ebx + 0x1e], cl
mov byte [ebx + 0x1f], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fbd9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40fc76
push ebx
push esi
call fcn.0040fba2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040cb5a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40fc23
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40fc75
push edi
push eax
call fcn.0040cb0c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40fc43
call fcn.0040cad2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40fc74
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040cb5a
add esp, 0x20
test eax, eax
jne 0x40fc62
push edi
call fcn.0040cad2
jmp 0x40fc6a
push ebx
call fcn.0040cad2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x410c5c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b508
push 0x41b500
push str.FlsAlloc
push 0x1e
call fcn.00410b1d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410c90
push dword [ebp + 8]
mov ecx, esi
call dword [0x4191c4]
call esi
jmp 0x410c96
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x410cda
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b518
push 0x41b510
push str.FlsGetValue
push 0x20
call fcn.00410b1d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410d11
push dword [ebp + 8]
mov ecx, esi
call dword [0x4191c4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]