joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10101a27
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
adc al, 0x24
mov edx, eax
mov eax, dword [esp]
xchg ebx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
jmp 0x10117dee
call fcn.100b17e4
jnp 0x100f9862
sub dword [edi + 0x14], eax
sbb ah, byte [ebx]
add byte es:[eax], al
lea esp, [esp + 4]
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 4]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
pushfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x5f]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
call fcn.100f98d8
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0xa]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xffff7ec7
xchg dword [esp], ecx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x46]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], ecx
push edx
mov edx, edi
pop edx
xchg dword [esp], ecx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x4a]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
popfd
push ebp
mov ebp, esp
leave
jmp 0x100f9890
mov eax, 0x1c9c1
call fcn.100fd3c4
Function at 0x10110346
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x4c]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xfffe1719
xchg dword [esp], edx
pushfd
add ebp, 0x7a
popfd
lea ebp, [ebp - 0x7a]
xchg dword [esp + 4], edx
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x7e]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], edx
push ebp
mov ebp, esp
leave
popfd
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x4b]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
jmp 0x10109a24
Function at 0x25128e10
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x25134190]
cmp ax, 0xcb
je 0x25128f0c
cmp ax, 0xcc
je 0x25128f0c
mov edx, dword [0x2513a5b0]
test edx, edx
je 0x25128e42
mov eax, dword [0x2513a450]
call edx
mov ebx, eax
jmp 0x25128e47
mov ebx, 0x2513a454
cmp word [0x2513a440], 0
jle 0x25128e6a
mov eax, 0x2513a420
call fcn.251290a0
mov eax, ebx
call fcn.251289f0
mov eax, ebx
call fcn.25128a60
mov edi, dword [ebx]
jmp 0x25128e8a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x25128e85
mov edx, edi
mov eax, ebx
call fcn.25127ec0
jmp 0x25128e88
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x25128e70
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x2513a440], 0
jle 0x25128f0c
mov edx, 0x2513a360
mov eax, ebx
call fcn.25127ff0
mov edi, eax
test edi, edi
je 0x25128edf
mov eax, dword [0x2513a3f4]
mov dword [edi + 0xc], eax
cmp dword [0x2513a3f4], 0
je 0x25128ed4
mov eax, dword [0x2513a3f4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x2513a3f4], eax
sub word [0x2513a440], 1
cmp word [0x2513a440], 0
sete bl
mov eax, 0x2513a420
call fcn.251290b0
test bl, bl
je 0x25128f0c
mov eax, 0x2513a420
call fcn.25129090
pop edi
pop esi
pop ebx
ret
Function at 0x2512a5d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x2513a240], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.2512a7b0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x2513a240]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.25122110
call sub.kernel32.dll_GetCommandLineA
mov dword [0x25134210], eax
mov esi, dword [0x25134210]
jmp 0x2512a770
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x2512a660
cmp byte [esi], 0
je 0x2512a779
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x2512a6d5
mov al, byte [esi]
cmp al, 1
jb 0x2512a6cb
sub al, 0x20
jbe 0x2512a69c
sub al, 2
je 0x2512a6af
jmp 0x2512a6cb
mov al, byte [ebp - 0x10c]
test al, al
je 0x2512a6da
add dword [ebp - 0x110], 1
jmp 0x2512a6d2
cmp byte [esi + 1], 0x22
je 0x2512a6c6
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x2512a6d2
add esi, 1
jmp 0x2512a6d2
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x2512a68c
test dword [ebp - 0x114], 0xffffffff
je 0x2512a769
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.2512a7b0
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x2513a240]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x2512a761
mov al, byte [esi]
cmp al, 1
jb 0x2512a757
sub al, 0x20
jbe 0x2512a728
sub al, 2
je 0x2512a73b
jmp 0x2512a757
mov al, byte [ebp - 0x10c]
test al, al
je 0x2512a766
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x2512a75e
cmp byte [esi + 1], 0x22
je 0x2512a752
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x2512a75e
add esi, 1
jmp 0x2512a75e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x2512a718
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x2512a663
mov ebx, dword [ebp - 0x114]
mov dword [0x2513a230], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x2513a240
call fcn.25128c70
mov eax, dword [0x2513a240]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2512b410
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x40]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x10], 0
push dword [ebp - 4]
mov ecx, 0xffffffff
mov edx, 0
mov eax, 4
call fcn.2512f2e0
mov dword [ebp - 0x14], eax
test eax, eax
je 0x2512b4b7
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.25126f50
call fcn.25127cb0
push eax
test eax, eax
jne 0x2512b496
push dword [ebp - 0xc]
push 0
push 0
push 4
push dword [ebp - 0x14]
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
test eax, eax
je 0x2512b4b2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
call fcn.25122110
push dword [ebp - 0x18]
call sub.kernel32.dll_UnmapViewOfFile
or eax, eax
setne al
mov byte [ebp - 0x10], al
call fcn.251271d0
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
pop eax
test eax, eax
je 0x2512b4b7
cmp eax, 2
je 0x2512b4b7
call fcn.25127300
pop eax
push 2
jmp 0x2512b496
mov al, byte [ebp - 0x10]
leave
ret
Function at 0x2512d5f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
lea eax, [edx + 0x214]
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 4]
call fcn.25127d30
mov eax, dword [ebp - 4]
mov edx, ebx
mov cl, 0
call fcn.25122150
mov eax, dword [ebp - 4]
mov byte [eax], 4
mov edx, dword [ebp - 4]
mov eax, esi
mov dword [edx + 0x210], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [ebp - 4]
mov dword [edx + 0x20c], eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
test esi, esi
je 0x2512d672
lea eax, [ebp - 8]
push eax
push esi
call sub.user32.dll_GetWindowThreadProcessId
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 8]
jne 0x2512d672
push 0x104
mov eax, dword [ebp - 4]
add eax, 2
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 4]
lea edx, [eax + 0x214]
mov eax, edi
mov ecx, dword [ebp - 0xc]
call fcn.25122110
push 0
push 0
push 0
push 0
mov eax, 0x2513af30
mov ecx, ebx
mov edx, dword [ebp - 4]
call fcn.251314e0
mov eax, dword [ebp - 4]
call fcn.25127d60
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2512e090
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x634]
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
cmp ebx, 0x8000
je 0x2512e0b5
cmp ebx, 0x8004
jne 0x2512e1b6
test esi, esi
je 0x2512e1b6
cmp dword [esi + 4], 2
jne 0x2512e1b6
lea eax, [ebp - 0x62c]
mov cl, 0
mov edx, 0x62c
call fcn.25122150
mov byte [ebp - 0x62c], 6
mov edi, 0
sub edi, 1
add edi, 1
mov eax, dword [esi + 0xc]
mov ecx, edi
shr eax, cl
cmp eax, 1
jne 0x2512e108
lea eax, [edi + 0x41]
call fcn.25125ea0
mov word [ebp - 0x620], ax
jmp 0x2512e10d
cmp edi, 0x19
jl 0x2512e0e8
cmp word [ebp - 0x620], 0
je 0x2512e1b6
mov word [ebp - 0x61e], 0x3a
mov word [ebp - 0x61c], 0x5c
mov word [ebp - 0x62a], bx
lea eax, [ebp - 0x620]
push eax
call sub.kernel32.dll_GetDriveTypeW
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x624], 0
push 1
call sub.kernel32.dll_SetErrorMode
mov ebx, eax
push 0x104
lea eax, [ebp - 0x416]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x624]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
call sub.kernel32.dll_GetVolumeInformationW
push ebx
call sub.kernel32.dll_SetErrorMode
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x62c]
mov eax, 0x2513af30
mov ecx, 0x62c
call fcn.251314e0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2512e4c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x25134a50], 0
je 0x2512e501
call fcn.2512e250
mov eax, dword [0x25134a50]
call fcn.25131d00
test al, al
je 0x2512e4ec
push 0
push dword [0x25134a50]
call sub.kernel32.dll_TerminateThread
push dword [0x25134a50]
call sub.kernel32.dll_CloseHandle
mov dword [0x25134a50], 0
leave
ret
Function at 0x25131e20
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x58]
push ebx
push esi
push edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], 0
lea eax, [ebp - 0x40]
mov cl, 0
mov edx, 0x24
call fcn.25122150
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 0x38]
mov ebx, 0
mov eax, dword [ebp - 0x50]
mov ecx, 0
sub eax, edx
sbb ecx, ebx
test ecx, ecx
jg 0x25131e70
jl 0x25131e7e
cmp eax, 0x7fffffff
jbe 0x25131e7e
mov edx, dword [ebp - 0x50]
lea eax, [edx - 0x7fffffff]
mov dword [ebp - 0x4c], eax
jmp 0x25131e84
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov edx, 0
mov ebx, dword [ebp - 0x50]
mov ecx, 0
sub eax, ebx
sbb edx, ecx
test edx, edx
jg 0x25131ea5
jl 0x25131eb0
cmp eax, 0x7fffffff
jbe 0x25131eb0
mov eax, dword [ebp - 0x50]
lea edx, [eax + 0x7fffffff]
jmp 0x25131eb3
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x58]
mov edi, edx
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x44], 0
lea ebx, [ebp - 0x1c]
mov al, 0
mov edx, 0x1c
mov cl, al
mov eax, ebx
call fcn.25122150
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x50]
call sub.kernel32.dll_VirtualQuery
test eax, eax
jbe 0x25131efe
mov eax, dword [ebp - 0x18]
sub eax, 0x10000
mov esi, eax
mov eax, dword [ebp - 0x18]
add eax, 0x10000
mov ebx, eax
jmp 0x25131fc4
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x50]
mov esi, eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x50]
sub edx, eax
mov ebx, edx
jmp 0x25131fc4
cmp esi, edi
jae 0x25131f6f
mov al, byte [ebp - 0x48]
test al, al
jne 0x25131f6f
push 1
push 0x2000
push dword [ebp - 0x3c]
push esi
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x54], eax
test dword [ebp - 0x54], 0xffffffff
je 0x25131f61
push 0x40
push 0x1000
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x54], eax
test dword [ebp - 0x54], 0xffffffff
jne 0x25131fd1
add esi, 0x10000
cmp esi, edi
jb 0x25131f6f
mov byte [ebp - 0x44], 0
cmp ebx, dword [ebp - 0x4c]
jbe 0x25131fc4
mov al, byte [ebp - 0x44]
test al, al
jne 0x25131fc4
push 1
push 0x2000
push dword [ebp - 0x3c]
push ebx
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x54], eax
test dword [ebp - 0x54], 0xffffffff
je 0x25131fb5
push 0x40
push 0x1000
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x54], eax
test dword [ebp - 0x54], 0xffffffff
jne 0x25131fd1
sub ebx, 0x10000
cmp ebx, dword [ebp - 0x4c]
ja 0x25131fc4
mov byte [ebp - 0x48], 0
cmp esi, edi
jae 0x25131fd1
cmp ebx, dword [ebp - 0x4c]
ja 0x25131f18
mov eax, dword [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x251322d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
mov dword [ebp - 4], eax
mov byte [ebp - 8], 0
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 4], 0
je 0x251323f9
mov eax, dword [ebp - 4]
call fcn.25131dd0
mov dword [ebp - 0x18], eax
test eax, eax
je 0x251323f9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
sub eax, edx
mov dword [ebp - 0x1c], eax
sub dword [ebp - 0x18], 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x251323f9
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov dword [ebp - 0x14], eax
cmp eax, 0x7fffffff
je 0x25132352
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.25126f50
call fcn.25127cb0
push eax
test eax, eax
jne 0x2513239a
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov ecx, 4
call fcn.25122110
cmp dword [0x25136030], 0
je 0x25132396
push 4
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentProcess
push eax
call dword [0x25136030]
mov byte [ebp - 8], 1
call fcn.251271d0
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0x7fffffff
je 0x251323be
push dword [ebp - 0x14]
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0x64
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x251323e1
cmp dword [ebp - 0x10], 0
jne 0x251323e1
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x251323ef
push dword [ebp - 0x10]
call sub.kernel32.dll_SetLastError
pop eax
test eax, eax
je 0x251323f9
call fcn.25127300
mov al, byte [ebp - 8]
leave
ret
Function at 0x25132400
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x48]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x10], 0
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0xc], 0
je 0x25132571
cmp dword [ebp - 4], 0
jne 0x25132443
push 0x8000
push 0
push dword [ebp - 0xc]
call sub.kernel32.dll_VirtualFree
mov byte [ebp - 0x10], 1
jmp 0x25132571
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.25131fe0
test al, al
je 0x25132569
mov eax, dword [ebp - 0xc]
call fcn.25131dd0
mov dword [ebp - 0x20], eax
test eax, eax
je 0x25132571
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x25132571
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov dword [ebp - 0x1c], eax
cmp eax, 0x7fffffff
je 0x251324ad
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.25126f50
call fcn.25127cb0
push eax
test eax, eax
jne 0x25132508
add dword [ebp - 0x20], 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov ecx, 5
call fcn.25122110
cmp dword [0x25136030], 0
je 0x251324f5
push 5
push dword [ebp - 4]
call sub.kernel32.dll_GetCurrentProcess
push eax
call dword [0x25136030]
push 0x8000
push 0
push dword [ebp - 0xc]
call sub.kernel32.dll_VirtualFree
mov byte [ebp - 0x10], 1
call fcn.251271d0
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], 0x7fffffff
je 0x2513252c
push dword [ebp - 0x1c]
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 5
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x2513254f
cmp dword [ebp - 0x18], 0
jne 0x2513254f
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x2513255d
push dword [ebp - 0x18]
call sub.kernel32.dll_SetLastError
pop eax
test eax, eax
je 0x25132567
call fcn.25127300
jmp 0x25132571
mov eax, dword [ebp - 0xc]
call fcn.251322d0
mov al, byte [ebp - 0x10]
leave
ret

Function at 0x25132650
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x2513267b
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x90
je 0x2513267b
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0xcc
je 0x2513267b
mov eax, 0
jmp 0x251326b1
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x251326ac
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, edx
movzx edx, byte [eax]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp dl, al
je 0x251326a6
mov eax, 0
jmp 0x251326b1
add dword [ebp - 4], 1
jmp 0x25132682
mov eax, 1
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x402b60
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0xadb064]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402ba9
push str.SetDefaultDllDirectories
push 0xa96750
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402ba9
push 0xc00
call eax
test eax, eax
jne 0x402c47
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c47
cmp eax, 0x104
ja 0x402c47
cmp word [ebp + eax*2 - 0x2d6], 0x5c
je 0x402be7
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402c46
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov al, byte [esi]
mov ecx, edi
inc esi
test al, al
je 0x402c20
movzx eax, al
mov word [ecx], ax
add ecx, 2
mov al, byte [esi]
inc esi
test al, al
jne 0x402c10
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
cmp byte [esi], 0
jne 0x402c07
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009ff0ea
mov esp, ebp
pop ebp
ret
Function at 0x407e70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.00a52330
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [ecx + eax]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x407f07
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0xa96780]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x407f50
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x407f34
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x407f30
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x407fa0
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x407f90
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x408f70
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x408fb9
cmp edx, 0x40
je 0x408fab
mov ecx, 0x40
lea edi, [esi + 0x40]
sub ecx, edx
add edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
lea edx, [esi + 0x40]
push 1
lea ecx, [esi + 0x20]
call eax
xor edx, edx
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.00a52330
mov ecx, dword [esi + 8]
lea edx, [esi + 0x40]
mov eax, dword [esi + 0xc]
add esp, 0xc
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
lea ecx, [esi + 0x20]
push 1
call eax
mov edi, dword [ebp + 0xc]
lea edx, [esi + 0x20]
mov ebx, 4
nop
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x409000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409060
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [section..data]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4

Function at 0x409810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.00a568b4
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x40983d
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc