joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2512ab94
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x25145ef8], 0
jne 0x2512ac75
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x2512abe7
push 0x10000
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov esi, eax
jmp 0x2512ac18
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x2512ac75
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x2512ac43
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x2512ac55
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x2512ac6f
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x2512e12c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x2512e1a8
cmp dword [esp + 0x10], 0x1000
jne 0x2512e1a8
cmp dword [esp + 4], 0
je 0x2512e1a8
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA
test eax, eax
je 0x2512e1a8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x2512e1a8
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x2512e1a8
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x25132594
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x25132654
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x251469e4]
call fcn.25129f28
push dword [ebp - 0xc]
push 0x25132670
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
movzx ecx, byte [ebp - 5]
mov eax, dword [0x251469e8]
call fcn.2513247c
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.25125dcc
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.25125ecc
push eax
call fcn.25132468
mov esi, eax
test esi, esi
je 0x25132631
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x2513262b
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2513265b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.2512578c
lea eax, [ebp - 4]
call fcn.25125720
ret

Function at 0x251328ac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov ebp, eax
xor esi, esi
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x2513290e
mov ebx, 0x71af0000
jmp 0x251328fc
cmp dword [esp + 0x10], 0x10000
jne 0x251328ea
push 0x40
push 0x2000
push ebp
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
jmp 0x2513290e
mov edi, dword [esp + 4]
cmp ebx, edi
jne 0x251328fa
sub ebx, 0x10000
jmp 0x251328fc
mov ebx, edi
push 0x1c
lea eax, [esp + 4]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
je 0x251328ca
push 0x40
push 0x1000
push ebp
push esi
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, esi
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x25132c08
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x25146abc]
cmp eax, 0x1c
jne 0x25132c83
cmp dword [ebp - 0xc], 0x1000
jne 0x25132c7e
cmp dword [ebp - 0x18], 0
je 0x25132c7e
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x25132c7e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x25132c5d
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x25132c83
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x25146a8c]
cmp eax, 0
je 0x25132c7e
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x25146ae0]
add ebx, dword [ebp - 0x10]
jmp 0x25132c1f
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x25136b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x25136d41
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, dword [0x25146954]
call fcn.2512df9c
mov dword [0x2514a068], eax
xor edx, edx
mov eax, dword [0x25146958]
call fcn.2512df9c
mov dword [0x2514a06c], eax
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 5
call fcn.25125f30
lea eax, [ebp - 4]
call fcn.25125bac
mov byte [eax], 0x72
lea eax, [ebp - 4]
call fcn.25125bac
mov byte [eax + 1], 0x64
lea eax, [ebp - 4]
call fcn.25125bac
mov byte [eax + 2], 0x65
lea eax, [ebp - 4]
call fcn.25125bac
mov byte [eax + 3], 0x63
lea eax, [ebp - 4]
call fcn.25125bac
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, dword [0x251469cc]
call fcn.25129f28
push dword [ebp - 0xc]
push 0x25136d60
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.25129a4c
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 4
call fcn.25125dcc
mov eax, dword [ebp - 4]
call fcn.25125ecc
push eax
push 0
push 0
call fcn.25127df8
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x25136d1e
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [0x2514a05c], esi
mov dword [0x2514a060], edi
cmp dword [0x2514a068], 0
je 0x25136c6e
cmp dword [0x2514a06c], 0
jne 0x25136cf0
mov dl, 1
mov eax, dword [0x251468d0]
call fcn.2512e0a8
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x25136d02
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x25136d02
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x25136d02
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x25136d02
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x25136d02
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x25136d02
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x2514a064], edx
mov edx, 0x25136b00
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 8]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov bl, 1
jmp 0x25136d02
push 0x25136aac
push 1
call dword [0x2514a068]
test eax, eax
setne bl
test bl, bl
jne 0x25136d1e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x25136d48
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.2512578c
lea eax, [ebp - 4]
call fcn.25125720
ret
Function at 0x25136d64
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x2514a068], 0
je 0x25136d7c
cmp dword [0x2514a06c], 0
jne 0x25136dd5
mov dl, 1
mov eax, dword [0x251468d0]
call fcn.2512e0a8
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x25136dbb
mov eax, dword [0x2514a064]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x25136de0
push 0x25136aac
call dword [0x2514a06c]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x2513adec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, eax
mov ebx, 0x2514a0ac
mov word [ebx], 0
mov word [ebx + 2], 0
mov word [ebx + 4], 0
mov word [ebx + 6], 0
lea eax, [ebx + 8]
call fcn.25125744
lea eax, [ebx + 0xc]
call fcn.25125744
lea eax, [ebx + 0x10]
call fcn.25125744
lea eax, [ebx + 0x14]
call fcn.25125744
lea eax, [ebx + 0x18]
call fcn.25125744
lea eax, [ebx + 0x1c]
call fcn.25125744
lea eax, [ebx + 0x20]
call fcn.25125744
lea eax, [ebx + 0x24]
call fcn.25125744
lea eax, [ebx + 0x28]
call fcn.25125744
lea eax, [ebx + 0x2c]
call fcn.25125744
push 0x10
push 1
push esi
call sub.kernel32.dll_FindResourceW
test eax, eax
je 0x2513aea3
push eax
push esi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x2513aea3
push eax
call sub.kernel32.dll_LockResource
test eax, eax
je 0x2513aea3
movzx edx, word [eax + 0x30]
mov word [ebx + 2], dx
movzx edx, word [eax + 0x32]
mov word [ebx], dx
movzx edx, word [eax + 0x34]
mov word [ebx + 6], dx
movzx edx, word [eax + 0x36]
mov word [ebx + 4], dx
call fcn.2513aca8
pop esi
pop ebx
ret
Function at 0x2513b1e4
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], edx
mov esi, eax
xor eax, eax
push ebp
push 0x2513b3f0
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.kernel32.dll_GlobalLock
mov edi, eax
test edi, edi
jne 0x2513b234
call sub.kernel32.dll_GetLastError_1
mov edx, 0x2513b400
mov ecx, eax
mov ax, 1
call fcn.251286f8
jmp 0x2513b3cc
push esi
call sub.kernel32.dll_GlobalSize
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x2513b3cc
lea eax, [ebp - 0x220]
xor ecx, ecx
mov edx, 0x20a
call fcn.25123e60
lea eax, [ebp - 0x220]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x230], eax
xor eax, eax
mov dword [ebp - 0x22c], eax
fild qword [ebp - 0x230]
add esp, 0xfffffffc
fstp dword [esp]
wait
lea eax, [ebp - 0x228]
call fcn.25128810
lea eax, [ebp - 0x228]
mov edx, 0x2513b44c
call fcn.25126350
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x224]
call fcn.25126254
mov eax, dword [ebp - 0x224]
call fcn.25126028
push eax
lea eax, [ebp - 0x220]
push eax
call sub.kernel32.dll_lstrcatW
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x220]
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x2513b313
call sub.kernel32.dll_GetLastError_1
mov edx, 0x2513b458
mov ecx, eax
mov ax, 1
call fcn.251286f8
push esi
call sub.kernel32.dll_GlobalUnlock
jmp 0x2513b3cc
lea eax, [ebp - 0x16]
xor ecx, ecx
mov edx, 0xe
call fcn.25123e60
mov word [ebp - 0x16], 0x4d42
mov dword [ebp - 0x14], 0xe
mov word [ebp - 0x10], 0
mov word [ebp - 0xe], 0
mov dword [ebp - 0xc], 0xe
push 0
lea eax, [ebp - 8]
push eax
push 0xe
lea eax, [ebp - 0x16]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x2513b390
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x2513b3a5
call sub.kernel32.dll_GetLastError_1
mov edx, 0x2513b498
mov ecx, eax
mov ax, 1
call fcn.251286f8
jmp 0x2513b3a5
call sub.kernel32.dll_GetLastError_1
mov edx, 0x2513b4e0
mov ecx, eax
mov ax, 1
call fcn.251286f8
push esi
call sub.kernel32.dll_GlobalUnlock
push ebx
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x220]
call fcn.2513b0f4
test al, al
jne 0x2513b3cc
lea eax, [ebp - 0x220]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2513b3f7
lea eax, [ebp - 0x228]
call fcn.251256fc
lea eax, [ebp - 0x224]
call fcn.25125744
ret
Function at 0x2513bb34
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x2513bd4d
push dword fs:[eax]
mov dword fs:[eax], esp
sub dx, 7
je 0x2513bb8c
sub dx, 0xfe
je 0x2513bc0d
sub dx, 0x1fc
je 0x2513bbc8
jmp 0x2513bd0e
mov esi, ebx
push esi
call sub.kernel32.dll_lstrlenA
test eax, eax
je 0x2513bd0e
mov eax, 0x2514a2f6
xor ecx, ecx
mov edx, 0x20a
call fcn.25123e60
push 0x104
push 0x2514a2f6
push 0xffffffffffffffff
push esi
push 1
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
jmp 0x2513bd0e
mov eax, 0x2514a2f6
xor ecx, ecx
mov edx, 0x20a
call fcn.25123e60
cmp word [ebx + 4], 0xe
jne 0x2513bbf2
mov eax, dword [ebx]
push eax
push 0x2514a2f6
call sub.kernel32.dll_lstrcpyW
jmp 0x2513bd0e
push 0x104
push 0x2514a2f6
push 0xffffffffffffffff
push ebx
push 1
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
jmp 0x2513bd0e
push 0x2514a2f6
call sub.kernel32.dll_lstrlenW
test eax, eax
je 0x2513bd0e
lea eax, [ebp - 0x20a]
xor ecx, ecx
mov edx, 0x20a
call fcn.25123e60
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x21c], eax
xor eax, eax
mov dword [ebp - 0x218], eax
fild qword [ebp - 0x21c]
add esp, 0xfffffffc
fstp dword [esp]
wait
lea eax, [ebp - 0x214]
call fcn.25128810
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x228]
mov edx, 0x2514a2f6
mov ecx, 0x105
call fcn.2512600c
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
call fcn.2513b198
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 0x220]
call fcn.25126240
mov edx, dword [ebp - 0x220]
pop eax
call fcn.25126350
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
call fcn.25126254
mov eax, dword [ebp - 0x210]
call fcn.25126028
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcatW
push 0
lea eax, [ebp - 0x20a]
push eax
push 0x2514a2f6
call sub.kernel32.dll_CopyFileW
lea eax, [ebp - 0x20a]
call fcn.2513b0f4
test al, al
jne 0x2513bd0e
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2513bd54
lea eax, [ebp - 0x228]
mov edx, 2
call fcn.251257bc
lea eax, [ebp - 0x220]
call fcn.251256fc
lea eax, [ebp - 0x214]
call fcn.251256fc
lea eax, [ebp - 0x210]
call fcn.25125744
ret
Function at 0x2513c9dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov dword [esp], edx
mov edi, eax
lea esi, [ebp + 0x214]
mov eax, esi
call fcn.25123a48
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, esi
call fcn.25123e60
mov byte [ebx], 4
mov dword [ebx + 0x210], edi
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx + 0x20c], eax
call sub.user32.dll_GetForegroundWindow
mov edi, eax
test edi, edi
je 0x2513ca48
lea eax, [esp + 4]
push eax
push edi
call sub.user32.dll_GetWindowThreadProcessId
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [esp + 4]
jne 0x2513ca48
push 0x104
lea eax, [ebx + 2]
push eax
push edi
call sub.user32.dll_GetWindowTextW
mov edx, ebx
add edx, 0x214
mov eax, dword [esp]
mov ecx, ebp
call fcn.25123b80
mov edx, esi
mov eax, ebx
call fcn.251286b4
mov eax, ebx
call fcn.25123a64
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x2513d2dc
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff9cc
mov ebx, edx
mov esi, eax
lea edi, [esp + 8]
cmp esi, 0x8000
je 0x2513d301
cmp esi, 0x8004
jne 0x2513d3b3
test ebx, ebx
je 0x2513d3b3
cmp dword [ebx + 4], 2
jne 0x2513d3b3
mov eax, edi
xor ecx, ecx
mov edx, 0x62c
call fcn.25123e60
mov byte [edi], 6
xor eax, eax
mov ecx, eax
mov edx, dword [ebx + 0xc]
shr edx, cl
cmp edx, 1
jne 0x2513d33b
lea edx, [eax + 0x41]
mov word [edi + 0xc], dx
jmp 0x2513d341
inc eax
cmp eax, 0x1a
jne 0x2513d326
cmp word [edi + 0xc], 0
je 0x2513d3b3
mov word [edi + 0xe], 0x3a
mov word [edi + 0x10], 0x5c
mov word [edi + 2], si
lea eax, [edi + 0xc]
push eax
call sub.kernel32.dll_GetDriveTypeW
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 8], eax
push 1
call sub.kernel32.dll_SetErrorMode
mov ebx, eax
push 0x104
lea eax, [edi + 0x216]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 8]
push eax
push 0x104
lea eax, [edi + 0x420]
push eax
lea eax, [edi + 0xc]
push eax
call sub.kernel32.dll_GetVolumeInformationW
push ebx
call sub.kernel32.dll_SetErrorMode
mov eax, edi
mov edx, 0x62c
call fcn.251286b4
add esp, 0x634
pop edi
pop esi
pop ebx
ret

Function at 0x2513d6a8
Capabilities:
Get common file path

Disassembly:
add esp, 0xfffffbe8
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x20a
call fcn.25123e60
lea eax, [esp + 0x20e]
xor ecx, ecx
mov edx, 0x20a
call fcn.25123e60
push 0x104
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
push 0x104
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
push 0x2513d740
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_lstrcatW
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_lstrcmpiW
test eax, eax
jne 0x2513d738
push 0
push 0
lea eax, [esp + 8]
push eax
mov ecx, 0x2513d4e4
xor edx, edx
xor eax, eax
call fcn.251255d4
mov dword [0x25146c18], eax
add esp, 0x418
ret
Function at 0x2513d75c
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x25146c18], 0
je 0x2513d797
call fcn.2513d474
mov eax, dword [0x25146c18]
call fcn.25128278
cmp al, 1
jne 0x2513d785
push 0
mov eax, dword [0x25146c18]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x25146c18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x25146c18], eax
ret

Function at 0x25140378
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov byte [ebp - 5], 0
push eax
or ecx, 0xffffffff
xor edx, edx
mov eax, 4
call fcn.2513e4c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x25140406
xor eax, eax
push ebp
push 0x251403ff
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
test ebx, ebx
jne 0x251403cd
call fcn.25124fe0
jmp 0x25140406
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, esi
call fcn.25123b80
push ebx
call sub.kernel32.dll_UnmapViewOfFile
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x25140406
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a6e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001a6f3
pop dword [ebp - 0x38]
mov eax, 0xad5d783
sub eax, 0xfad43090
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3d233
push 0
mov eax, 0xbc58c47
add eax, 0x43dd495
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xdb788244
add ecx, 0x2487b87e
xor edx, edx
add edx, eax
mov edi, 0x1003be00
add edi, dword [ebp - 0x38]
mov esi, 0x725ab7e
add esi, 0xd51f6ad7
xor dword [ebp - 0x28], 0x4febd161
mov ebx, dword [edi]
add dword [ebp - 8], 0x47713b81
sub ebx, esi
sub dword [ebp - 0x30], esi
mov dword [edx], ebx
sub dword [ebp - 0x2c], eax
add edx, 4
add edi, 0x86077c44
add edi, 0x79f883c0
loop 0x1001a74e
add eax, 0xdd7f7b91
add eax, 0x2281624a
xor ebx, ebx
add ebx, eax
add eax, 0x54b51557
add eax, 0xab4aeaae
mov ecx, 0xc95533b5
sub ecx, 0xb95533b5
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a6e4
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a6e4
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret