joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b74f
Capabilities:
Hide graphical window

Disassembly:
push 0x44
mov eax, 0x54598b
call fcn.00533f59
mov ebx, ecx
push 0
call fcn.0042c3ef
push 1
mov ecx, ebx
call fcn.0042c944
push 0x198
lea eax, [ebp - 0x20]
push eax
call fcn.0040e049
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 2
push dword [ebx + 4]
call edi
push esi
push eax
call fcn.0040e8bd
push dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.00533f14
pop ecx
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
lea ecx, [ebp - 0x50]
call fcn.0042514e
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
call fcn.0042514e
lea esi, [ebx + 0x210]
mov dword [ebp - 4], 2
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x1d8]
lea edi, [ebx + 0x1e0]
push edi
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], eax
call fcn.00425421
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.00425421
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x40], 0
je 0x42b879
cmp dword [ebp - 0x4c], 0
mov byte [ebx + 0x22b], 1
jne 0x42b866
push str.7_Zip
lea ecx, [ebp - 0x50]
call fcn.00409520
cmp byte [0x5f2eb8], 0
jne 0x42b8e1
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x42b8af
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42b8bb
mov byte [ebx + 0x22b], 1
cmp dword [ebp - 0x28], eax
je 0x42b8bb
cmp dword [ebp - 0x34], eax
jne 0x42b89e
push str.7_Zip
lea ecx, [ebp - 0x38]
call fcn.00409520
cmp byte [0x5f2eb8], 0
jne 0x42b8e1
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x10]
cmp byte [0x5f2eb8], 0
jne 0x42b8e1
test eax, eax
je 0x42b8e1
cmp byte [ebx + 0x160], 0
jne 0x42b8e1
mov ecx, ebx
mov byte [ebx + 0x155], 1
call fcn.0042c7d0
jmp 0x42b8ec
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.0042539f
mov al, 1
call fcn.00533f27
ret
Function at 0x42bc49
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov eax, dword [edx]
lea esi, [edi + 0xb4]
cmp eax, dword [esi]
jne 0x42bc7c
cmp dword [edx + 8], 0xffffff65
jne 0x42bc7c
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x42bc9e
sub eax, 0x14
je 0x42bc84
dec eax
sub eax, 1
je 0x42bc9e
xor al, al
pop edi
pop esi
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x42bc7c
mov ecx, esi
call fcn.0042c236
mov al, 1
jmp 0x42bc7e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x42bc7c
mov ecx, edi
call fcn.0042573f
jmp 0x42bc9a

Function at 0x42d708
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x5ec268]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5f2eb9], 0
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
jne 0x42d775
push esi
push edx
lea eax, [ebp - 0x2c4]
push eax
call fcn.0040a2d8
push 0x4010
push 0x160
lea ecx, [ebp - 0x164]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 0x80
push ecx
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x2c4]
mov esi, eax
call fcn.00533f14
pop ecx
mov ecx, dword [ebp - 0x160]
mov eax, esi
pop esi
jmp 0x42d7a2
mov eax, dword [0x5f2eb0]
test eax, eax
je 0x42d79c
push 0x4010
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 0x80
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x2b4]
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00533c96
leave
ret 0xc

Function at 0x42d7b3
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x5ec268]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov edx, 0x4011
test al, al
mov ecx, 0x4110
lea eax, [ebp - 0x164]
cmovne ecx, edx
push ecx
push 0x160
push eax
push 0x90
push 0x547720
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00533c96
leave
ret 4
Function at 0x42ec80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545ddd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5ec268]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.00533ecd
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x42eccb
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp 0x42eccd
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x42ed30
push 0
push 0
call fcn.00539243
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x42ed14
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00533c96
mov esp, ebp
pop ebp
ret 8
push 6
mov dword [edi], 0
call fcn.00535596
int3
Function at 0x475850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545ddd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5ec268]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.00533ecd
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x47589b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp 0x47589d
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x475900
push 0
push 0
call fcn.00539243
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4758e4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00533c96
mov esp, ebp
pop ebp
ret 8
push 6
mov dword [edi], 0
call fcn.00535596
int3
Function at 0x51cee0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea esi, [ebp - 0x12c]
xor bl, bl
mov edi, 0x10
nop dword [eax]
movzx edx, bl
lea esi, [esi + 4]
add edx, ecx
add bl, 4
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
mov dword [esi - 4], ecx
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x51cf00
lea eax, [ebp - 0x128]
mov ebx, 0x30
nop
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax + 0x30]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x51cf40
mov ebx, dword [ebp - 4]
add ebx, 0x50
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x40
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [ebp - 0x14], xmm0
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov edi, ebx
mov esi, dword [ebp - 0x20]
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror edi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor edi, eax
mov eax, ebx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x10]
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 4]
add edi, ecx
add dword [ebp - 4], 4
add edi, dword [eax + 0x54c228]
add edi, dword [ebp + eax - 0x12c]
add edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, edx
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
add ebx, edi
mov eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov ecx, eax
mov dword [ebp - 0x20], eax
rol eax, 0xa
ror ecx, 0xd
xor ecx, eax
mov eax, dword [ebp - 0x24]
ror eax, 2
xor ecx, eax
mov eax, esi
or eax, edx
and esi, edx
and eax, dword [ebp - 0x24]
add ecx, edi
or eax, esi
add eax, ecx
sub dword [ebp - 0x28], 1
mov dword [ebp - 0x24], eax
jne 0x51cfa3
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp - 0x2c]
mov edx, 8
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x51d043
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51d140
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
xor eax, eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp + 0xc], eax
jbe 0x51d307
mov edx, dword [ebp + 8]
push esi
push edi
mov ecx, dword [ebx + 0x40]
mov al, byte [eax + edx]
mov byte [ebx + ecx], al
inc dword [ebx + 0x40]
cmp dword [ebx + 0x40], 0x40
jne 0x51d2f5
xor al, al
lea esi, [ebp - 0x138]
mov byte [ebp - 1], al
mov edi, 0x10
nop dword [eax + eax]
movzx ecx, al
lea esi, [esi + 4]
movzx eax, byte [ecx + ebx]
add ecx, ebx
shl eax, 8
movzx edx, byte [ecx + 1]
or edx, eax
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 8
or edx, eax
mov al, byte [ebp - 1]
add al, 4
mov dword [esi - 4], edx
mov byte [ebp - 1], al
sub edi, 1
jne 0x51d190
lea eax, [ebp - 0x134]
lea ebx, [edi + 0x30]
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax + 0x30]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x51d1d0
mov ebx, dword [ebp - 0x30]
add ebx, 0x50
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], 0x40
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [ebp - 0x18], xmm0
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov edi, ebx
mov esi, dword [ebp - 0x24]
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror edi, 0xb
not ecx
and ecx, dword [ebp - 0x10]
xor edi, eax
mov eax, ebx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x14]
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 8]
add edi, ecx
add dword [ebp - 8], 4
add edi, dword [eax + 0x54c228]
add edi, dword [ebp + eax - 0x138]
add edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, edx
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
add ebx, edi
mov eax, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov dword [ebp - 0x24], eax
rol eax, 0xa
ror ecx, 0xd
xor ecx, eax
mov eax, dword [ebp - 0x28]
ror eax, 2
xor ecx, eax
mov eax, esi
or eax, edx
and esi, edx
and eax, dword [ebp - 0x28]
add ecx, edi
or eax, esi
add eax, ecx
sub dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], eax
jne 0x51d233
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x38]
mov edx, 8
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x51d2d3
mov ebx, dword [ebp - 0x30]
add dword [ebx + 0x48], 0x200
mov dword [ebx + 0x40], edx
adc dword [ebx + 0x4c], edx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, dword [ebp + 0xc]
jb 0x51d162
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401000
Capabilities:
Get token membership

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x36], 0
mov word [esp + 0x3a], 0x500
lea eax, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
lea eax, [esp + 0x36]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
mov dword [esp + 0x2c], eax
test eax, eax
je 0x4010b0
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push eax
mov eax, dword [esp + 0x2c]
add esp, 0x3c
ret

Function at 0x4010b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [esp + 0x24]
movzx ebp, bl
mov ax, word [ebp + ebp + 0x405040]
mov word [esp + 6], ax
mov esi, dword [0x405018]
mov edi, dword [0x40501c]
cmp esi, edi
jae 0x40112c
shl esi, 8
mov dword [0x405018], esi
mov eax, dword [section..bss]
lea edx, [eax + 1]
mov dword [section..bss], edx
mov dl, byte [eax]
mov eax, dword [0x40500c]
mov byte [eax], dl
mov eax, dword [0x40501c]
shl eax, 8
mov dword [0x40501c], eax
mov edx, dword [0x405014]
shl edx, 8
mov dword [0x405014], edx
add edx, eax
jae 0x4010d3
not eax
mov dword [0x405014], eax
jmp 0x4010d3
mov eax, dword [0x405014]
lea edx, [edi + eax]
xor edx, edi
cmp edx, 0xffffff
jbe 0x4010e3
cmp eax, 0xffff
jbe 0x4010e3
movzx ecx, word [esp + 6]
mov dword [esp], ecx
xor edx, edx
div ecx
mov ecx, eax
mov dword [0x405014], eax
mov eax, esi
sub eax, edi
xor edx, edx
div ecx
mov dword [esp + 8], eax
mov al, 1
mov edx, dword [esp + 8]
cmp dword [esp], edx
jbe 0x4011ee
movzx ebx, bl
shl ebx, 9
add ebx, 0x405240
mov edx, ebx
xor eax, eax
movzx esi, word [edx]
add esi, eax
cmp dword [esp + 8], esi
jb 0x401191
add edx, 2
mov eax, esi
jmp 0x40117f
imul eax, ecx
add edi, eax
mov dword [0x40501c], edi
mov eax, edx
sub eax, ebx
sar eax, 1
mov ecx, dword [esp + 0x20]
mov byte [ecx], al
movzx eax, word [edx]
lea ecx, [eax + 1]
mov word [edx], cx
imul eax, dword [0x405014]
mov dword [0x405014], eax
mov si, word [esp + 6]
inc si
jne 0x4011e4
xor eax, eax
mov cx, word [ebx + eax*2]
mov edx, ecx
shr dx, 1
and ecx, 1
or edx, ecx
mov word [ebx + eax*2], dx
add esi, edx
inc eax
cmp eax, 0x100
jne 0x4011c8
mov word [ebp + ebp + 0x405040], si
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401411
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x20
mov byte [0x405005], 0
mov word [0x405022], 0
mov dword [0x405018], 0
mov dword [0x40501c], 0
mov word [0x405026], 0
mov byte [0x435275], 0
mov word [0x405028], 0
mov dword [section..bss], 0x402020
mov dword [0x405014], 0xffffffff
mov word [0x405024], 0xffff
mov dword [0x405010], 0x40501f
mov dword [0x40500c], 0x405018
mov byte [0x405004], 0xff
xor eax, eax
mov ecx, eax
shl ecx, 9
xor edx, edx
mov word [ecx + edx*2 + 0x405240], 1
inc edx
cmp edx, 0x100
jne 0x401493
mov word [eax + eax + 0x405040], 0x100
inc eax
cmp eax, 0x100
jne 0x40148c
xor eax, eax
mov byte [eax + 0x425240], 0xff
inc eax
cmp eax, 0x10000
jne 0x4014ba
mov eax, 4
shl dword [0x405018], 8
mov edx, dword [section..bss]
lea ecx, [edx + 1]
mov dword [section..bss], ecx
mov cl, byte [edx]
mov edx, dword [0x40500c]
mov byte [edx], cl
dec eax
jne 0x4014ce
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
mov al, 1
cmp ebx, 0xffffffff
je 0x40157f
call fcn.004011f6
test al, al
jne 0x401573
mov dword [esp + 0x10], 0
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x405020
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x40153a
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
add esp, 0x20
pop ebx
ret
Function at 0x401584
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x464
lea ebx, [esp + 0x50]
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edx
push edx
test eax, eax
je 0x401701
lea esi, [esp + 0x25a]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x403000
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x401701
mov dword [esp], esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
push ecx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebp
mov word [esp + eax*2 + 0x254], 0
mov dword [esp + 8], esi
mov dword [esp + 4], str._lsps1
mov dword [esp], ebx
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
call ebp
mov dword [esp], ebx
call fcn.00401411
test al, al
jne 0x401701
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x30], 1
mov dword [esp + 0x18], 0x40
mov eax, dword [section..data]
mov dword [esp + 0x20], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__ExecutionPolicy_Bypass__f___ls_
mov dword [esp], esi
call ebp
mov dword [esp + 0x24], str.powershell
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push edx
test eax, eax
je 0x4016fb
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push ebp
test eax, eax
je 0x4016c4
mov dword [esp + 4], 0xffffffff
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push ecx
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
jmp 0x4016ed
mov dword [esp + 0xc], 0x1010
mov eax, dword [0x402008]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x403070
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push edx
mov dword [esp], ebx
call edi
push eax
add esp, 0x464
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40170c
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create process on windows
Terminate process

Disassembly:
push edi
push esi
push ebx
sub esp, 0x130
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push esi
push esi
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_ExitProcess]
je 0x4017a5
mov ebx, eax
mov dword [esp + 8], 0x403250
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
sub esp, 0xc
mov dword [0x435278], eax
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x4017ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4017c9
mov dword [esp + 0xc], 0x1010
mov eax, dword [0x402008]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4030d4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
mov dword [esp], ebx
call edi
push ebx
mov dword [esp], 0
call esi
mov dword [esp + 0xc], 0x1010
mov eax, dword [0x402008]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x403136
jmp 0x40178f
mov dword [esp + 0x1c], 0x114
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
push ecx
cmp dword [esp + 0x20], 9
ja 0x401814
mov dword [esp + 0xc], 0x1010
mov eax, dword [0x402008]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40316a
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
jmp 0x4018b6
cmp dword [esp + 0x18], 2
jg 0x4018b6
call fcn.00401000
test eax, eax
je 0x401851
cmp dword [esp + 0x18], 2
jne 0x401851
mov eax, dword [str.proceed]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push edx
push edx
test eax, eax
jne 0x4018b6
call fcn.00401584
jmp 0x4018b6
mov dword [esp + 0xc], 0x1134
mov dword [esp + 8], 0x4031c4
mov dword [esp + 4], 0x4031d8
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x10
cmp eax, 6
jne 0x4018b6
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov eax, dword [str.proceed]
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp + 8], eax
mov eax, dword [section..data]
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
mov eax, dword [0x435278]
test eax, eax
je 0x40179f
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x40179f
Function at 0x458ee0
Capabilities:
Terminate process

Disassembly:
jmp 0x4b2ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4b2bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0045bacd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x45907f
Capabilities:
Query environment variable

Disassembly:
jmp 0x4fbc15
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4fbc26
pop esi
ret
push ebx
push edi
push esi
call fcn.004fbafc
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00459b88
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4fbc4e
push ebx
push esi
push edi
call fcn.0045b852
add esp, 0xc
push 0
call fcn.0045c653
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x45b01e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x471e66
push edi
mov edi, dword [esp + 0x14]
lea ecx, [esp + 8]
call fcn.0045c10d
test eax, eax
je 0x471ef3
push esi
xor esi, esi
cmp dword [esp + 0x1c], esi
jbe 0x471ef2
push ebx
push ebp
mov ebx, 0x45649c
mov ebp, 0x567d90
mov al, byte [edi + esi]
xor al, 0x73
push ebx
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebp
mov byte [edi + esi], al
call fcn.00458d6e
pop ecx
pop ecx
mov ecx, eax
call fcn.0045cccf
mov al, byte [edi + esi]
push ebx
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebp
mov byte [edi + esi], al
call fcn.00458d6e
pop ecx
pop ecx
mov ecx, eax
call fcn.0045cccf
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x5165e4
mov byte [edi + esi], al
call fcn.0045818e
xor byte [edi + esi], al
inc esi
pop ecx
cmp esi, dword [esp + 0x24]
jb 0x471e8d
pop ebp
pop ebx
pop esi
lea ecx, [esp + 8]
call fcn.00459b7e
pop edi
ret 0x14

Function at 0x45b933
Capabilities:
Parse pe header

Disassembly:
jmp 0x4a1780
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a17bf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a17bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a17bf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a17bf
cmp dword [ecx + 0x74], 0xe
jbe 0x4a17bf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x49f952
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.004590fc
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x49f991
sub eax, 1
je 0x49f98c
sub eax, 1
je 0x49f988
xor eax, eax
leave
ret
push 3
jmp 0x49f993
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret