joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x1531e90]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46167d
sub esp, 0x68
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x102
call fcn.0045f880
mov eax, dword [esp + 0x74]
test byte [eax], al
mov ecx, eax
mov eax, 0xaaaaaaab
mov edx, dword [esp + 0x70]
mov ebx, edx
mul edx
shr edx, 1
lea eax, [edx + edx*2]
sub ebx, eax
lea eax, [ecx + ebx*4 + 0xe0]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x64], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x44], ebp
mov esi, dword [esp + 0x14]
mov dword [esp + 0x40], esi
mov dword [esp], eax
call fcn.004068b0
mov eax, dword [esp + 4]
test eax, eax
je 0x46151e
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x4615a6
mov eax, dword [esp + 0x74]
lea ecx, [eax + 0xe0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
call fcn.00462430
movzx eax, byte [esp + 8]
test al, al
jne 0x46154f
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x4615a6
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
movzx ebx, byte [eax + 0x6e]
mov ebp, dword [esp + 0x64]
mov dword [esp], ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x1c], 4
mov byte [esp + 0x1d], bl
call fcn.00462140
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x60], ebx
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x70]
mov ecx, eax
and eax, 1
mov edx, dword [esp + 0x74]
lea eax, [edx + eax*8 + 0xec]
mov edi, dword [eax]
mov esi, dword [eax + 4]
add edi, 1
mov dword [esp + 0x3c], edi
mov dword [eax], edi
adc esi, 0
mov dword [eax + 4], esi
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x78]
mov dword [esp], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call fcn.00461ed0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
lea edi, [esp + 0x48]
mov edx, eax
xor eax, eax
call fcn.0047187a
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov eax, dword [eax + 0x54]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x15
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.0045faa0
add esp, 0x68
ret
call fcn.004701e0
jmp fcn.00461490
Function at 0x4653b0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x1531e90]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46544b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x1531e90]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00471877
lea ecx, [0x465460]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004700f0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004701e0
jmp fcn.004653b0
Function at 0x471490
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x1532600]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46fc1b
je 0x46fc6e
cmp ebx, 0x20
jbe 0x46fc74
cmp ebx, 0x40
jbe 0x46fcba
jmp 0x46fd5b
test ebx, ebx
je 0x46fc64
add eax, 0x10
test ax, 0xff0
je 0x46fc50
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x1053940]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x1053a40]
jmp 0x46fc38
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46fc38
pxor xmm1, xmmword [0x1532610]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x1532610]
pxor xmm2, xmmword [0x1532620]
pxor xmm3, xmmword [0x1532630]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x1532610]
pxor xmm2, xmmword [0x1532620]
pxor xmm3, xmmword [0x1532630]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46fdba
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x1531ca9], 0
je 0x4714aa
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46fbe0
jmp fcn.0040d520
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x57376175
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2cfe2a95
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401420
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, 1
test byte [0x5b4fb4], al
jne 0x40145c
or dword [0x5b4fb4], eax
xor eax, eax
push 0x569950
mov dword [0x5b4fa0], eax
mov dword [0x5b4fa4], eax
mov dword [0x5b4fa8], eax
mov dword [0x5b4fac], eax
mov dword [0x5b4fb0], eax
call fcn.005194de
add esp, 4
mov eax, dword [0x5b4fa8]
test eax, eax
je 0x4014ac
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x5b4fa8]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov esi, eax
mov eax, dword [0x5b4fa8]
test eax, eax
je 0x40149d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5b4fa8], 0
test esi, esi
pop esi
je 0x4014ac
cmp dword [esp], 0
jne 0x4014ac
xor al, al
pop ecx
ret
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
push edx
push 0x5b4fb0
call fcn.004ae9d0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add esp, 0xc
push 0
push 0
push 0x5b4fa0
push 0x4012f0
push 0
push 0
mov dword [0x5b4fa4], eax
mov dword [0x5b4fa0], ecx
mov dword [0x5b4fac], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x5b4fa8], eax
setne al
pop ecx
ret

Function at 0x401960
Capabilities:
Check os version

Disassembly:
push esi
push 0x114
mov esi, ecx
push 0
push esi
call fcn.00519500
add esp, 0xc
push esi
mov dword [esi], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esi + 0x10]
cmp eax, 2
sete cl
mov byte [esi + 0x114], cl
cmp eax, 2
jne 0x4019ab
mov ecx, dword [esi + 4]
cmp ecx, 5
ja 0x4019a4
jne 0x4019ab
cmp dword [esi + 8], 1
jb 0x4019ab
mov ecx, 1
jmp 0x4019ad
xor ecx, ecx
mov byte [esi + 0x115], cl
cmp eax, 2
jne 0x4019cd
cmp dword [esi + 4], 6
jbe 0x4019cd
mov eax, 1
mov byte [esi + 0x116], al
mov eax, esi
pop esi
ret
xor eax, eax
mov byte [esi + 0x116], al
mov eax, esi
pop esi
ret
Function at 0x401ef0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x74
push esi
push 0x44
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00519500
mov eax, dword [esp + 0x8c]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
push eax
push ecx
mov dword [esp + 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [esp + 0x84], 0
jne 0x401f60
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
mov eax, dword [esp + 8]
pop esi
add esp, 0x74
ret
test eax, eax
je 0x4020e1
mov edx, dword [esp + 8]
push ebx
push ebp
push edi
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x402091
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x401fb0
cmp dword [esp + 0x10], 0x103
jne 0x402091
push 0xa
call ebp
push 1
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
je 0x402079
lea esp, [esp]
mov eax, dword [esp + 0x28]
cmp eax, 0xa0
jb 0x401ff2
cmp eax, 0xa9
jbe 0x40200b
cmp eax, 0x200
jb 0x402000
cmp eax, 0x20d
jbe 0x40200b
lea ecx, [eax - 0x100]
cmp ecx, 9
ja 0x40204d
cmp eax, 0xa0
je 0x402062
cmp eax, 0x200
je 0x402062
cmp eax, 0x202
je 0x402062
cmp eax, 0xa2
je 0x402062
cmp eax, 0x105
je 0x402062
cmp eax, 0x106
je 0x402062
cmp eax, 0x101
je 0x402062
cmp eax, 0x102
je 0x402062
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x402062
lea edx, [esp + 0x24]
push edx
call edi
lea eax, [esp + 0x24]
push eax
call ebx
cmp dword [esp + 0x28], 0x12
je 0x4020b1
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
call esi
test eax, eax
jne 0x401fe0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x401fb0
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x74
ret
mov ecx, dword [esp + 0x20]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x74
ret
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
xor eax, eax
pop esi
add esp, 0x74
ret
Function at 0x4022d0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [str.SoftwareJeticoBCWipeTaskManager]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40232a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push eax
mov eax, dword [esp + 8]
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx

Function at 0x403150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f073
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0
push 0xffffffffffffffff
push 0x56ba1c
call fcn.00402e30
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 4], 0
lea esi, [edi + 0x20]
xor eax, eax
mov dword [esi], eax
mov dword [esp + 0x24], 0
mov dword [esi + 4], eax
push 0x30
push eax
push edi
mov byte [esp + 0x30], 1
call fcn.00519500
add esp, 0x18
push str.SoftwareJeticoBCWipeTM
mov ecx, esi
mov dword [esi + 8], SysStringLen
call fcn.00401ad0
push str.Flags
mov ecx, esi
mov dword [esi], eax
call fcn.00401ad0
mov dword [esi + 4], eax
mov byte [edi + 0x2c], 1
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x403c00
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 1
sete al
mov byte [esi], al
test al, al
jne 0x403c23
mov eax, 1
pop esi
ret 4
push edi
mov edi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0xd
call edi
test eax, eax
je 0x403c3b
mov dword [esi + 4], 0xd
jmp 0x403c4a
push 1
call edi
test eax, eax
je 0x403c6c
mov dword [esi + 4], 1
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 8], eax
test eax, eax
je 0x403c65
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esi + 0xc], eax
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov eax, 2
pop esi
ret 4
Function at 0x403e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x14]
call fcn.0049eff0
push 0xffa
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.0049f100
test eax, eax
jne 0x403efa
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], vtable.cWCS.0
call fcn.0049ee80
mov eax, str._NULL_
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x38]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
push edx
push eax
push ecx
mov byte [esp + 0x34], 1
call fcn.004a2b30
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call fcn.0049f100
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0049e930
mov esi, dword [esi + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], vtable.cWCS.0
call fcn.0049ee80
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret

Function at 0x4040d0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0x4040c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x4040f0
pop esi
pop ecx
ret
mov eax, dword [esp + 0xc]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 8]
push ecx
push esi
mov edi, eax
mov dword [esp + 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
test edi, edi
je 0x404124
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x404290
Capabilities:
Impersonate user

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x20]
push edi
mov dword [esi + 0x28], 0
mov dword [ebx], 0
test eax, eax
jne 0x4042fd
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [esp + 0x10]
lea edi, [esi + 0x24]
push edi
push 1
or ecx, 0xe
push ecx
push eax
mov dword [ebx], eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x4042ec
cmp dword [edi], 0
jne 0x4042e2
pop edi
mov dword [esi + 0x28], 0xffffffff
mov eax, esi
pop esi
pop ebx
ret 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x404315
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x28], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
lea edi, [esi + 0x24]
push edi
push 2
push 2
push 0
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x4042e8
mov edx, dword [edi]
push ebp
push edx
lea eax, [esp + 0x1c]
push eax
push 0
call fcn.00404130
add esp, 4
mov ecx, eax
call fcn.004911d0
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov edx, dword [edi]
push esi
push edx
mov dword [esi], 0x20
mov dword [esi + 8], ecx
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x404369
call ebp
mov dword [esi + 0x28], eax
cmp dword [ebx], 0
je 0x404381
mov eax, dword [edi]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x404381
call ebp
mov dword [esi + 0x28], eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x4055b0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x54f390
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 1
call fcn.00490c50
add esp, 4
test al, al
je 0x405681
mov eax, dword [str.PhysDriveInfo]
mov ecx, dword [str.SOFTWAREJeticoBCWipe]
xor ebx, ebx
push ebx
push ebx
push 3
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004b7bc0
add esp, 0x18
push 0x400
lea ecx, [esp + 0x28]
call fcn.0049f020
mov esi, vtable.cWCStr.0
mov dword [esp + 0x24], esi
push 0x400
lea ecx, [esp + 0x38]
mov dword [esp + 0x64], ebx
call fcn.0049f020
mov dword [esp + 0x34], esi
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
push edx
push eax
mov byte [esp + 0x68], 1
call fcn.004b84f0
add esp, 8
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x405698
mov esi, vtable.cWCS.0
lea ecx, [esp + 0x34]
mov byte [esp + 0x60], bl
mov dword [esp + 0x34], esi
call fcn.0049ee80
lea ecx, [esp + 0x24]
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x24], esi
call fcn.0049ee80
or eax, 0xffffffff
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
push 1
mov byte [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x20], eax
mov byte [esp + 0x60], 2
xor ebp, ebp
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp esi, 4
je 0x405761
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x28]
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push edi
mov dword [esp + 0x24], ebx
call fcn.004bba30
add esp, 0x10
test eax, eax
je 0x405732
mov edi, dword [esp + 0x38]
cmp esi, 2
jne 0x40572d
xor edx, edx
cmp word [edi], 0x41
sete dl
movzx eax, dx
push eax
call fcn.00519e45
add esp, 4
test ax, ax
jne 0x405761
mov edx, dword [esp + 0x38]
xor ecx, ecx
cmp word [edx], 0x42
sete cl
movzx eax, cx
push eax
call fcn.00519e45
add esp, 4
test ax, ax
je 0x405732
jmp 0x405761
cmp esi, 5
je 0x405761
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
cmp edi, ebx
je 0x40574c
push edi
lea ecx, [esp + 0x48]
call fcn.00404c80
cmp dword [esp + 0x48], ebx
mov byte [esp + 0x60], 2
lea ecx, [esp + 0x44]
jle 0x40575c
inc ebp
call fcn.004047f0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
push ecx
push edx
push esi
call fcn.004b85a0
add esp, 0xc
test eax, eax
jne 0x4056b0
push esi
call fcn.004b8660
mov eax, dword [str.SOFTWAREJeticoBCWipe]
push eax
call fcn.00493de0
mov ecx, dword [esp + 0x28]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, vtable.cWCS.0
lea ecx, [esp + 0x34]
mov byte [esp + 0x60], bl
mov dword [esp + 0x34], esi
call fcn.0049ee80
lea ecx, [esp + 0x24]
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x24], esi
call fcn.0049ee80
mov eax, ebp
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret