joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2481f60
Capabilities:
Get disk information

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, edx
jne 0x2481f79
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2481f9b
push esi
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
mov dword [edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
lea edx, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.0247fbd0
test eax, eax
jne 0x2481fd0
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0xc], ebx
je 0x2481fc7
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0xc], ebx
je 0x2481ff2
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x2482000
Capabilities:
Set file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, edx
je 0x2482076
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2482030
push edi
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
jne 0x248208c
pop edi
pop esi
pop ebx
add esp, 8
ret
lea edx, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.0247fbd0
test eax, eax
jne 0x2482051
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
jmp 0x2482069
mov eax, dword [esp + 0x10]
push edi
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
jne 0x248207f
cmp eax, ebx
je 0x2482076
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp eax, ebx
je 0x248208c
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x24820a0
Capabilities:
Move file

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp edi, esi
mov ebx, edx
je 0x248213c
cmp ebx, esi
je 0x248213c
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x24820e0
push ebx
push edi
call dword [sym.imp.kernel32.dll_MoveFileW]
test eax, eax
jne 0x24821b6
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea edx, [esp + 0x14]
mov ecx, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
call fcn.0247fbd0
test eax, eax
je 0x248210e
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.0247fbd0
test eax, eax
jne 0x2482145
mov eax, dword [esp + 0x10]
cmp eax, esi
mov dword [esp + 0xc], esi
je 0x2482127
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
mov dword [esp + 0x14], esi
je 0x248213c
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], esi
jne 0x2482190
cmp eax, esi
je 0x2482172
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
mov dword [esp + 0x14], esi
je 0x248213c
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
cmp eax, esi
je 0x24821a1
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
mov dword [esp + 0x14], esi
je 0x24821b6
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x24822a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
cmp ebp, ebx
push edi
jne 0x24822bd
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret
push 0x104
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x14], bl
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x24822df
pop edi
pop ebp
pop ebx
add esp, 0x104
ret
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dd5b0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
or ecx, 0xffffffff
lea edi, [esp + 0xc]
mov byte [esp + 0x10f], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
cmp edx, 0x104
jb 0x2482323
pop edi
pop ebp
pop ebx
add esp, 0x104
ret
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dd5b0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
or ecx, 0xffffffff
push esi
mov esi, edi
lea edx, [esp + 0x10]
mov edi, edx
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
or ecx, 0xffffffff
mov esi, edi
lea edx, [esp + 0x10]
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x24826f0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
mov ebp, edx
mov ebx, ecx
jne 0x2482711
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
push edi
push edi
push ebp
push ebx
jae 0x24827f9
mov esi, dword [sym.imp.kernel32.dll_GetLocaleInfoW]
call esi
cmp eax, edi
jne 0x248273e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x10]
lea edi, [eax + eax + 2]
call fcn.024017d0
test edi, edi
je 0x2482785
push edi
call fcn.024acf00
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
je 0x2482785
mov dword [esp + 0x10], edi
mov word [eax], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
shr eax, 1
push eax
push ecx
push ebp
push ebx
call esi
test eax, eax
jne 0x248279a
lea ecx, [esp + 0x10]
call fcn.024017d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
shr edx, 1
xor esi, esi
mov word [eax + edx*2 - 2], si
mov edx, dword [esp + 0x14]
call fcn.0247f900
test eax, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], esi
jne 0x24827dd
cmp eax, esi
je 0x24827d1
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
cmp eax, esi
je 0x24827ea
push eax
call fcn.024ad03a
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
cmp eax, edi
jne 0x248280f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
lea edi, [eax + 1]
test edi, edi
je 0x2482825
push edi
call fcn.024acf00
mov esi, eax
add esp, 4
test esi, esi
jne 0x2482831
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
push edi
push esi
push ebp
push ebx
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
jne 0x2482857
push esi
call fcn.024ad03a
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x1c]
mov ecx, esi
mov byte [esi + edi - 1], 0
call fcn.0247fc70
test eax, eax
push esi
jne 0x24827e2
call fcn.024ad03a
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x2486f30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x24cc54c]
push ebx
mov ebx, dword [0x24cc558]
push esi
push edi
mov edi, dword [esp + 0x28]
test edi, edi
mov esi, edx
mov edx, dword [0x24cc554]
mov dword [esp + 0xc], ecx
mov ecx, dword [0x24cc550]
jbe 0x2486fb8
push ebp
lea ebp, [edi + 0xf]
mov edi, dword [esp + 0x28]
shr ebp, 4
xor eax, dword [edi]
mov dword [esp + 0x14], eax
xor ecx, dword [edi + 4]
xor edx, dword [edi + 8]
mov dword [esp + 0x1c], edx
xor ebx, dword [edi + 0xc]
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x10]
push eax
lea edx, [esp + 0x18]
mov dword [esp + 0x24], ebx
call fcn.02476650
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
add edi, 0x10
add esi, 0x10
dec ebp
jne 0x2486f66
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8

Function at 0x2486fd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x24cc554]
push ebx
mov ebx, dword [0x24cc54c]
push ebp
mov ebp, dword [0x24cc550]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
test eax, eax
mov dword [esp + 8], ecx
mov ecx, dword [0x24cc558]
push esi
mov esi, edx
mov dword [esp + 0x2c], ecx
jbe 0x248708d
add eax, 0xf
shr eax, 4
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x3c], eax
mov edx, dword [edi]
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
push esi
mov edx, edi
mov dword [esp + 0x1c], eax
call fcn.02477150
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esp + 0x1c]
xor eax, ebp
mov ebp, dword [esi + 8]
xor ecx, ebx
mov ebx, dword [esi + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
xor ebp, eax
mov eax, dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x30]
xor ebx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x18]
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x14]
add edi, 0x10
add esi, 0x10
dec eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x3c], eax
jne 0x2487016
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8

Function at 0x2489cc0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x2489ce2
xor eax, eax
add esp, 0x190
ret
cmp word [esp], 0x101
je 0x2489cf9
call sub.wsock32.dll_WSACleanup
xor eax, eax
add esp, 0x190
ret
mov eax, 1
add esp, 0x190
ret

Function at 0x2489d50
Capabilities:
Connect socket

Disassembly:
mov eax, dword [ecx]
push 0x10
push edx
push eax
call sub.wsock32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x2489d90
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push eax
mov eax, dword [esp + 0xc]
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [edx]
push eax
push ecx
call sub.wsock32.dll_send
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [esi], eax
pop esi
mov eax, edx
ret 0xc

Function at 0x2489dc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push eax
mov eax, dword [esp + 0xc]
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [edx]
push eax
push ecx
call sub.wsock32.dll_recv
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [esi], eax
pop esi
mov eax, edx
ret 0xc

Function at 0x2489e40
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [ecx]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
push edx
push ecx
call sub.wsock32.dll_setsockopt
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
ret 0xc

Function at 0x2489ec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x24c3337
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
call fcn.0247c320
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 2
call fcn.0247c320
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 3
call fcn.0247f4d0
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 4
call fcn.0247d4a0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2180], edi
mov dword [esi + 0x2184], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x2188], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x248bdd9
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_InterlockedIncrement]
push esi
mov esi, ecx
push edi
lea ebx, [esi + 4]
push ebx
call ebp
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x248c3f0
push 0x64
push 0
call fcn.024adeaf
mov edi, eax
add esp, 0x18
test edi, edi
je 0x248be15
add esi, 8
push esi
call ebp
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jne 0x248be2c
test esi, esi
je 0x248be2c
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x248cda0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 2
mov esi, ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
jne 0x248cdb5
pop esi
ret 8
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x248cdc5
pop esi
ret 8
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
test eax, eax
jne 0x248cdd4
pop esi
ret 8
cmp dword [eax], 0x28
jae 0x248cddf
xor eax, eax
pop esi
ret 8
mov ecx, dword [eax + 4]
test ecx, ecx
jge 0x248cde8
neg ecx
mov edx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [eax + 8]
test ecx, ecx
jge 0x248cdf7
neg ecx
mov dword [edx + 4], ecx
xor ecx, ecx
mov cx, word [eax + 0xe]
xor edx, edx
mov dx, word [eax + 0xc]
mov eax, dword [esp + 0xc]
pop esi
imul ecx, edx
mov dword [eax], ecx
mov eax, 1
ret 8
Function at 0x248f530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x24cc5f0
push 0x24ae518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edi, ecx
test edi, edi
je 0x248f6be
test ebx, ebx
je 0x248f6be
mov eax, dword [ebp + 8]
test eax, eax
je 0x248f6be
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x248f6be
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], edi
push 0x40
push edi
call fcn.0248f500
test eax, eax
je 0x248f6b7
cmp word [edi], 0x5a4d
jne 0x248f6b7
mov eax, dword [edi + 0x3c]
lea esi, [eax + edi]
cmp edi, esi
ja 0x248f6b7
cmp eax, 0x7fffffff
jg 0x248f6b7
mov dword [ebp - 0x1c], esi
push 4
push esi
mov edx, ebx
mov ecx, edi
call fcn.0248f500
test eax, eax
je 0x248f6b7
cmp dword [esi], 0x4550
jne 0x248f6b7
push 0x14
lea eax, [esi + 4]
push eax
mov edx, ebx
mov ecx, edi
call fcn.0248f500
test eax, eax
je 0x248f6b7
cmp word [esi + 6], 0x3e8
ja 0x248f6b7
test byte [esi + 0x16], 2
je 0x248f6b7
xor eax, eax
mov ax, word [esi + 0x14]
sub eax, 0xe0
je 0x248f645
sub eax, 0x10
jne 0x248f6b7
mov dword [ebp - 0x20], esi
push 0xf0
lea ecx, [esi + 0x18]
push ecx
mov edx, ebx
mov ecx, edi
call fcn.0248f500
test eax, eax
je 0x248f6b7
add esi, 0x98
jmp 0x248f661
push 0xe0
lea edx, [esi + 0x18]
push edx
mov edx, ebx
mov ecx, edi
call fcn.0248f500
test eax, eax
je 0x248f6b7
add esi, 0x88
mov dword [ebp - 0x28], esi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x248f6b7
mov eax, dword [esi]
test eax, eax
je 0x248f6b7
push ecx
push eax
mov edx, ebx
xor ecx, ecx
call fcn.0248f500
test eax, eax
je 0x248f6b7
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x248f6e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x24cc600
push 0x24ae518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, edx
mov dword [ebp - 0x40], edi
mov ebx, ecx
test ebx, ebx
je 0x248f8be
test edi, edi
je 0x248f8be
mov eax, dword [ebp + 8]
test eax, eax
je 0x248f8be
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x248f8be
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x248f8be
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], ebx
push 0x40
push ebx
call fcn.0248f500
test eax, eax
je 0x248f8b7
cmp word [ebx], 0x5a4d
jne 0x248f8b7
mov eax, dword [ebx + 0x3c]
lea esi, [eax + ebx]
cmp ebx, esi
ja 0x248f8b7
cmp eax, 0x7fffffff
jg 0x248f8b7
mov dword [ebp - 0x20], esi
push 0xf8
push esi
mov edx, edi
mov ecx, ebx
call fcn.0248f500
test eax, eax
je 0x248f8b7
cmp dword [esi], 0x4550
jne 0x248f8b7
xor edx, edx
mov dx, word [esi + 0x14]
mov ecx, edx
and ecx, 0xffff
cmp ecx, 0x7fffffff
jg 0x248f8b7
mov ax, word [esi + 6]
cmp ax, 0x3e8
ja 0x248f8b7
test dx, dx
je 0x248f8b7
test byte [esi + 0x16], 2
je 0x248f8b7
cmp word [esi + 4], 0x14c
jne 0x248f8b7
lea ecx, [ecx + esi + 0x18]
mov dword [ebp - 0x1c], ecx
and eax, 0xffff
lea eax, [eax + eax*4]
shl eax, 3
push eax
push ecx
mov edx, edi
mov ecx, ebx
call fcn.0248f500
test eax, eax
je 0x248f8b7
xor edi, edi
mov dword [ebp - 0x28], edi
xor ecx, ecx
mov cx, word [esi + 6]
cmp edi, ecx
jae 0x248f8b7
lea edx, [edi + edi*4]
mov eax, dword [ebp - 0x1c]
lea esi, [eax + edx*8]
mov ecx, dword [esi]
mov dword [ebp - 0x34], ecx
mov edx, dword [esi + 4]
mov dword [ebp - 0x30], edx
mov byte [ebp - 0x2c], 0
mov edx, 0x24dd8ec
lea ecx, [ebp - 0x34]
call fcn.0248f440
test eax, eax
je 0x248f8a2
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x10]
cmp eax, edi
jae 0x248f856
mov edi, eax
mov dword [ebp - 0x38], edi
push edi
mov eax, dword [esi + 0x14]
add eax, ebx
push eax
mov edx, dword [ebp - 0x40]
mov ecx, ebx
call fcn.0248f500
test eax, eax
je 0x248f8b7
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
mov dword [edx], edi
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc edi
mov dword [ebp - 0x28], edi
mov esi, dword [ebp - 0x20]
jmp 0x248f813
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x248fc50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x24cc630
push 0x24ae518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, edx
mov esi, ecx
test esi, esi
je 0x248fd7c
test ebx, ebx
je 0x248fd7c
mov eax, dword [ebp + 8]
test eax, eax
je 0x248fd7c
mov dword [ebp - 4], 0
mov dword [eax], 0
mov dword [ebp - 0x24], esi
push 0x40
push esi
call fcn.0248f500
test eax, eax
je 0x248fd75
cmp word [esi], 0x5a4d
jne 0x248fd75
mov eax, dword [esi + 0x3c]
lea edi, [eax + esi]
cmp esi, edi
ja 0x248fd75
cmp eax, 0x7fffffff
jg 0x248fd75
mov dword [ebp - 0x1c], edi
push 4
push edi
mov edx, ebx
mov ecx, esi
call fcn.0248f500
test eax, eax
je 0x248fd75
cmp dword [edi], 0x4550
jne 0x248fd75
push 0x14
lea eax, [edi + 4]
push eax
mov edx, ebx
mov ecx, esi
call fcn.0248f500
test eax, eax
je 0x248fd75
test byte [edi + 0x16], 2
je 0x248fd75
xor eax, eax
mov ax, word [edi + 0x14]
sub eax, 0xe0
je 0x248fd54
sub eax, 0x10
jne 0x248fd75
mov dword [ebp - 0x20], edi
push 0xf0
jmp 0x248fd59
mov edx, dword [edi + 0x50]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xe0
lea ecx, [edi + 0x18]
push ecx
mov edx, ebx
mov ecx, esi
call fcn.0248f500
test eax, eax
jne 0x248fd2d
jmp 0x248fd75
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2491c20
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.024adb70
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
test eax, eax
je 0x2491c69
push eax
call dword [sym.imp.kernel32.dll_GetFileType]
test eax, eax
je 0x2491c69
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x24df620
call fcn.024ae7e9
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.024ae799
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x2491d6b
call dword [sym.imp.user32.dll_GetDesktopWindow]
call dword [sym.imp.user32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x2491d26
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.user32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x2491d26
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x2491d26
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x2491d26
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.024adb70
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.user32.dll_GetUserObjectInformationW]
test eax, eax
je 0x2491d26
mov ecx, dword [ebp - 4]
push 0x24ce968
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.024ae758
add esp, 8
test eax, eax
je 0x2491d6b
push 0x24ce990
push 0
call dword [sym.imp.advapi32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.advapi32.dll_ReportEventA]
push esi
call dword [sym.imp.advapi32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push 0x24ce980
push ecx
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2492870
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x249fd50
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret

Function at 0x24acba0
Capabilities:
Create thread

Disassembly:
call 0x24acba0
call 0x24acba0
call 0x24acba0
call 0x24acba0
call 0x24acba0
call 0x24acba0
call 0x24acba0
call 0x24acba0
call 0x24acba0
call 0x24acba0
jmp 0x24acba0
push esi
mov dword [0x24e4af8], 0
mov dword [0x24e4b04], 1
push 0
push 0x400
push 0x24acc40
call fcn.024afcfa
mov esi, dword [sym.imp.kernel32.dll_Sleep]
add esp, 0xc
push 0x10
call esi
mov dword [0x24e4b04], 0
push 1
call esi
mov eax, dword [0x24e4af8]
shr eax, 3
mov ecx, dword [0x24e4af8]
xor eax, ecx
shr eax, 3
mov edx, dword [0x24e4b00]
xor eax, edx
mov ecx, dword [0x24e4af8]
xor eax, ecx
mov dword [0x24e4af8], eax
mov edx, dword [0x24e4af8]
and edx, 7
mov dword [0x24e4af8], edx
mov eax, dword [0x24e4af8]
mov dword [0x24e4b00], eax
mov ecx, dword [0x24e4afc]
shl ecx, 3
mov edx, dword [0x24e4af8]
xor ecx, edx
mov dword [0x24e4afc], ecx
mov eax, dword [0x24e4afc]
pop esi
ret