joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30003c5a
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x3004f800]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x30003d04
call edi
mov esi, eax
cmp esi, ebx
je 0x3001d6a8
mov dword [0x3004f800], 1
cmp esi, ebx
je 0x3001d6c9
cmp word [esi], bx
mov eax, esi
je 0x30003cad
add eax, ebp
cmp word [eax], bx
jne 0x30003c9f
add eax, ebp
cmp word [eax], bx
jne 0x30003c9f
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x30003cf4
push ebp
call fcn.30003d0e
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x30003cf4
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x3001d6dc
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
je 0x30003c90
jmp 0x3001d6ef
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x3001d6bf
mov eax, ebp
mov dword [0x3004f800], eax
jmp 0x30003d04
mov eax, dword [0x3004f800]
jmp 0x30003d04
call edi
mov esi, eax
cmp esi, ebx
jne 0x30003c98
xor eax, eax
jmp 0x30003cfd
push dword [esp + 0x10]
call fcn.30012ff9
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x30003cf0
cmp eax, ebp
je 0x3001d6f7
cmp eax, ebx
jne 0x3001d6d5
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x3001d6d5
cmp byte [esi], bl
je 0x3001d711
inc eax
cmp byte [eax], bl
jne 0x3001d707
inc eax
cmp byte [eax], bl
jne 0x3001d707
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.30003d0e
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x3001d72c
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
jmp 0x3001d6d5
push ebp
push esi
push edi
call main
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x30003cfd

Function at 0x30003e2c
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x30003e6a
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x3001de9b
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jae 0x3001de9b
pop edi
pop esi
pop ebx
ret
xor eax, eax
jmp 0x30003e66
add edx, 1
add eax, 0x28
cmp edx, esi
jae 0x30003e6a
jmp 0x30003e4e
Function at 0x300056c4
Capabilities:
Accept command line arguments

Disassembly:
push 0x244
mov eax, 0x3004294c
call fcn.30013068
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x30016c9b
xor esi, esi
cmp dword [ebp - 0x10], esi
jle 0x30005726
push dword [edi + esi*4]
lea ecx, [ebp - 0x38]
call fcn.30012c7b
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
call main
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.30013250
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x300056f9
push edi
call dword [sym.imp.kernel32.dll_GlobalFree]
call fcn.300130d6
ret 4
push 0x30016cd4
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x250]
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x144]
lea edi, [ebp - 0x144]
push eax
rep movsd dword es:[edi], dword [esi]
call main
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
dec esp
imul ebp, dword [esi + 0x65], 0x72416f54
jbe 0x30016d3d
and byte [esi + 0x61], ah
imul ebp, dword [ebp + 0x64], 0x6d246800
add dword [eax], esi
lea eax, [ebp - 0x24c]
push 0x1c
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x140]
lea edi, [ebp - 0x140]
push eax
rep movsd dword es:[edi], dword [esi]
call main
nop
nop
dec ebp
outsd dx, dword [esi]
jne 0x30016d95
and byte gs:[esi + 0x69], ah
insb byte es:[edi], dx
and byte gs:[esi + 0x61], ch
insd dword es:[edi], dx
and byte gs:[ecx + 0x73], ch
and byte [edi + ebp*2 + 0x6e], ch
jb 0x30016d5f
jb 0x30016d5f
je 0x30016da9
popal
outsb dx, byte [esi]
and byte [ebp + 0x41], cl
pop eax
pop edi
push eax
inc ecx
push esp
dec eax
add byte [eax - 0x78], ch
insd dword es:[edi], dx
add dword [eax], esi
jne 0x30016e09
add byte gs:[eax - 0x30], ch
xchg dword [ecx], eax
add byte [ebx + 0x436a0cc4], al
Function at 0x30009ad7
Capabilities:
Query environment variable

Disassembly:
push 0x234
mov eax, 0x30041d80
call fcn.30013068
mov edi, ecx
lea ecx, [ebp - 0x28]
call fcn.3000b691
and dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x28]
call main
mov ecx, eax
call main
lea ecx, [ebp - 0x28]
call main
mov esi, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call main
mov eax, dword [eax + 8]
push esi
mov esi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
push eax
push dword [edi + 8]
call esi
lea ecx, [ebp - 0x28]
mov ebx, eax
call main
cmp ebx, dword [eax + 0xc]
ja 0x3001621f
test ebx, ebx
je 0x30016253
lea ecx, [ebp - 0x28]
call main
push eax
mov ecx, edi
call main
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.3000b71c
call fcn.300130d6
ret
push ebx
lea ecx, [ebp - 0x28]
call main
mov ecx, eax
call main
lea ecx, [ebp - 0x28]
call main
mov ebx, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call main
mov eax, dword [eax + 8]
push ebx
push eax
push dword [edi + 8]
call esi
mov ebx, eax
jmp 0x30009b3e
push 0x3001628c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x240]
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x134]
lea edi, [ebp - 0x134]
push eax
rep movsd dword es:[edi], dword [esi]
call main
inc esi
popal
imul ebp, dword [ebp + 0x64], 0x206f7420
js 0x30016309
popal
outsb dx, byte [esi]
and byte fs:[ebp + 0x6e], ah
jbe 0x3001630a
jb 0x30016312
outsb dx, byte [esi]
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x300162c9
jbe 0x3001630c
jb 0x30016316
popal
bound ebp, qword [ebp + 0x73]
add byte [ebx + 0x56], dl
enter 0x6ce8, 0xffffffffffffffc9
leave
invalid
pop ebp
cld
Function at 0x3000ce60
Capabilities:
Enumerate files on windows

Disassembly:
push 0x4ec
mov eax, 0x3004288d
call fcn.3000fdda
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], eax
call main
test al, al
je 0x30016b6c
mov ecx, esi
call main
lea ecx, [ebp - 0x2b8]
call fcn.300123e5
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x2b8]
call main
mov esi, 0x300113cc
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push 1
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 0
call fcn.30013250
test bl, bl
je 0x3000cf19
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 2
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0
call fcn.30013250
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2b8]
call main
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.30012f0c
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x264], eax
je 0x30016ba0
mov ecx, edi
call fcn.30012f0c
push eax
lea ecx, [ebp - 0x2e0]
call fcn.30012c7b
push esi
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30012c7b
push 1
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 4
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 3
call fcn.30013250
test bl, bl
je 0x3000cfcd
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30013250
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.30012c7b
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 6
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30013250
lea eax, [ebp - 0x2e0]
push eax
call main
test al, al
je 0x3000d026
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x2e0]
push eax
call main
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0
call fcn.30013250
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x3000cf52
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.30013250
call fcn.3000c84f
ret 0xc
push 0x30020158
lea eax, [ebp - 0x4f8]
push 0x22
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x3ec]
lea edi, [ebp - 0x3ec]
push eax
rep movsd dword es:[edi], dword [esi]
call main
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 3
je 0x3000d05c
cmp eax, 2
je 0x3000d05c
push 0x30016bcc
push eax
lea eax, [ebp - 0x4f8]
push eax
call main
jmp 0x30016b7f
Function at 0x3000fe34
Capabilities:
Enumerate files on windows

Disassembly:
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x2e0]
push eax
call main
jmp 0x3001001e
push 0x4ec
mov eax, 0x300427f1
call fcn.3000fdda
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], eax
call main
test al, al
je 0x30016af3
mov ecx, esi
call main
lea ecx, [ebp - 0x2b8]
call fcn.300123e5
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x2b8]
call main
mov esi, 0x300113cc
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push 1
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 0
call fcn.30013250
test bl, bl
je 0x3000feed
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 2
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0
call fcn.30013250
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2b8]
call main
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.30012f0c
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x264], eax
je 0x30016b27
mov ebx, dword [sym.imp.kernel32.dll_lstrcmpW]
push 0x30010dd8
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x3001002d
push 0x3001006c
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x3001002d
mov ecx, edi
call fcn.30012f0c
push eax
lea ecx, [ebp - 0x2e0]
call fcn.30012c7b
push esi
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30012c7b
push 1
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 4
call main
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 3
call fcn.30013250
test bl, bl
je 0x3000ffd3
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30013250
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.30012c7b
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 6
call main
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30013250
lea eax, [ebp - 0x2e0]
push eax
call main
test al, al
jne 0x3000c27c
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0
call fcn.30013250
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x3000ff26
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.30013250
call fcn.3000c84f
ret 0xc
push 0x30020158
lea eax, [ebp - 0x4f8]
push 0x22
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x3ec]
lea edi, [ebp - 0x3ec]
push eax
rep movsd dword es:[edi], dword [esi]
call main
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 3
je 0x30010054
cmp eax, 2
je 0x30010054
push 0x30016b54
push eax
lea eax, [ebp - 0x4f8]
push eax
call main
jmp 0x30016b06
Function at 0x300123d7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30053c20]
jne 0x30029b84
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30055320], eax
mov dword [0x3005531c], ecx
mov dword [0x30055318], edx
mov dword [0x30055314], ebx
mov dword [0x30055310], esi
mov dword [0x3005530c], edi
mov word [0x30055338], ss
mov word [0x3005532c], cs
mov word [0x30055308], ds
mov word [0x30055304], es
mov word [0x30055300], fs
mov word [0x300552fc], gs
pushfd
pop dword [0x30055330]
mov eax, dword [ebp]
mov dword [0x30055324], eax
mov eax, dword [ebp + 4]
mov dword [0x30055328], eax
lea eax, [ebp + 8]
mov dword [0x30055334], eax
mov eax, dword [ebp - 0x320]
mov dword [0x30055270], 0x10001
mov eax, dword [0x30055328]
mov dword [0x30055224], eax
mov dword [0x30055218], 0xc0000409
mov dword [0x3005521c], 1
mov eax, dword [0x30053c20]
mov dword [ebp - 0x328], eax
mov eax, dword [section..data]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x30055268], eax
push 1
call fcn.30029d1c
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x30029c88
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x30055268], 0
jne 0x30029c74
push 1
call fcn.30029d1c
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x300249a6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x490
mov eax, 0x30043020
call fcn.30013068
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jne 0x300249f2
push 0x30024ba8
lea eax, [ebp - 0x390]
push 0x3a
push eax
call main
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x178]
rep movsd dword es:[edi], dword [esi]
push 0x30049d54
lea eax, [ebp - 0x178]
push eax
call main
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x10], 1
call fcn.30012f0c
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
push eax
push dword [esi + 0x30]
call edi
cmp eax, ebx
jle 0x30024a2c
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x80070002
mov dword [ebp - 0x14], eax
je 0x30024b5d
cmp dword [ebp - 0x18], 7
jne 0x30024b5d
cmp eax, ebx
jge 0x30024a76
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
lea ecx, [esi + 8]
call fcn.30012f0c
push eax
push 0x30024b68
push dword [ebp - 0x14]
lea eax, [ebp - 0x390]
push eax
call main
add esp, 0x14
jmp 0x300249d4
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x10], eax
shr eax, 1
push eax
lea ecx, [ebp - 0x6c]
call fcn.30024693
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call main
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.30012f0c
push eax
push dword [esi + 0x30]
call edi
cmp eax, ebx
jle 0x30024abb
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jge 0x30024b05
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
lea ecx, [esi + 8]
call fcn.30012f0c
push eax
push 0x30024b68
lea eax, [ebp - 0x49c]
push edi
push eax
call main
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x284]
rep movsd dword es:[edi], dword [esi]
push 0x30049d54
lea eax, [ebp - 0x284]
jmp 0x300249ec
push ebx
lea ecx, [ebp - 0x6c]
call main
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.300123e5
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x40]
call main
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
call main
lea ecx, [ebp - 0x40]
call fcn.3001164b
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x30024b1c
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.30013250
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.30024702
mov al, 1
jmp 0x30024b5f
xor al, al
call fcn.300130d6
ret 8
Function at 0x3002f571
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x3002f580
pop dword [ebp - 0x3c]
mov eax, 0x7d529b14
add eax, 0xb2b05a6c
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x42127
push 0
mov eax, 0x839bc87c
add eax, 0xac644924
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xd077bc80
sub ecx, 0xd07783ea
mov esi, eax
mov edi, 0xd804570b
add edi, 0x5802c4f5
add edi, dword [ebp - 0x3c]
mov ebx, 0xeb71e4ca
add ebx, 0xc9aa387e
xor dword [ebp - 0x24], 0x6d15ebf2
mov edx, dword [edi]
xor dword [ebp - 4], 0xdcfec4e4
add edx, ebx
add dword [ebp - 0x18], eax
mov dword [esi], edx
mov dword [ebp - 0x1c], 0x7f722e56
add esi, 0x16d79880
sub esi, 0x16d7987c
add edi, 4
loop 0x3002f5df
add eax, 0xcbc82846
sub eax, 0xcbc7531b
mov ebx, eax
add eax, 0xb0b272f5
add eax, 0x4f4d8d10
mov ecx, 0x355b3b6a
sub ecx, 0x55b3b6a
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x402e7e
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e9b
mov dword [ebp - 8], ExpandEnvironmentStringsA
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402eaa
mov ebx, 0x417928
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ebf
mov ecx, dword [0x446c58]
add ecx, eax
push ecx
call fcn.00402e67
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.00402e35
test eax, eax
jne 0x402ed6
push 0xfffffffffffffffd
pop eax
jmp 0x40302f
test dword [ebp + 0x14], 0x80000000
je 0x40300e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x427930
mov dword [ebp - 0xc], eax
call fcn.00406395
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40302c
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f16
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x413928
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
sub dword [ebp + 0x14], esi
mov dword [0x427948], edi
mov dword [0x42794c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x427930
mov dword [0x427950], ebx
mov dword [0x427954], eax
call fcn.004063b5
mov dword [ebp - 0x14], eax
test eax, eax
jl 0x403000
mov esi, dword [0x427950]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x446cf4], 1
mov edi, eax
je 0x402fb4
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f81
cmp dword [ebp + 0x14], 0
jne 0x402fb4
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.0040490d
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402ff5
cmp dword [ebp + 0x10], eax
jne 0x402fdd
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403007
cmp dword [ebp - 0x10], esi
jne 0x403007
add dword [ebp - 4], esi
jmp 0x402fe9
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x427950]
cmp dword [ebp - 0x14], 1
jne 0x402f35
jmp 0x40302c
cmp dword [ebp + 0x14], eax
jg 0x402f09
jmp 0x40302c
push 0xfffffffffffffffc
jmp 0x402ed0
push 0xfffffffffffffffe
jmp 0x402ed0
test edi, edi
je 0x403075
cmp dword [ebp + 0x14], esi
jge 0x40301a
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403041
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x413928
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403007
cmp esi, dword [ebp + 0x10]
jne 0x403007
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403036
jmp 0x40302c
Function at 0x405263
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [0x446c0c]
push edi
push 3
call fcn.00405b0e
xor ebx, ebx
cmp eax, ebx
je 0x405294
push 1
push ebx
call eax
movzx eax, ax
cdq
push edx
push eax
push 0x477000
call fcn.00405860
jmp 0x4052de
push ebx
mov edi, 0x4319e8
push edi
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [0x477000], 0x7830
call fcn.004057e9
cmp byte [0x4319e8], bl
jne 0x4052d3
push ebx
push edi
push 0x40750e
push str..DEFAULTControl_PanelInternational
push 0x80000003
call fcn.004057e9
push edi
push 0x477000
call sub.KERNEL32.dll_lstrcatA
call fcn.0040393e
mov eax, dword [0x446c68]
and eax, 0x20
mov ebp, 0x471000
push ebp
mov dword [0x446cc0], eax
mov dword [0x446cdc], 0x10000
call fcn.00405be7
test eax, eax
jne 0x40538e
mov ecx, dword [esi + 0x48]
cmp ecx, ebx
je 0x40538e
mov eax, dword [0x446c38]
mov edx, dword [esi + 0x4c]
push ebx
mov edi, 0x43eba0
push edi
add edx, eax
push edx
add ecx, eax
push ecx
push dword [esi + 0x44]
call fcn.004057e9
mov al, byte [0x43eba0]
cmp al, bl
je 0x40538e
cmp al, 0x22
jne 0x40534d
push 0x22
mov edi, 0x43eba1
push edi
call fcn.00405697
mov byte [eax], bl
push edi
call sub.KERNEL32.dll_lstrlenA
lea eax, [eax + edi - 4]
cmp eax, edi
jbe 0x405381
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405381
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40537b
test al, 0x10
jne 0x405381
push edi
call fcn.00405bc0
push edi
call fcn.00405b93
push eax
push ebp
call fcn.004059bd
push ebp
call fcn.00405be7
test eax, eax
jne 0x4053a4
push dword [esi + 0x118]
push ebp
call fcn.00405cbf
push 0x8040
push ebx
push ebx
push 1
push 0x67
push dword [0x446c08]
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x442bd0], eax
cmp dword [esi + 0x50], 0xffffffff
mov edi, 0x442ba0
je 0x405458
mov ecx, dword [0x446c08]
mov dword [0x442bb4], eax
lea eax, [esp + 0x10]
push edi
mov dword [esp + 0x14], 0x624e5f
mov dword [0x442ba4], 0x401000
mov dword [0x442bb0], ecx
mov dword [0x442bc4], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x405527
push ebx
lea eax, [esp + 0x18]
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push ebx
push dword [0x446c08]
push ebx
push ebx
push eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
push eax
push dword [esp + 0x30]
lea eax, [esp + 0x2c]
push dword [esp + 0x30]
push 0x80000000
push ebx
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x42b9e4], eax
push ebx
call fcn.0040141a
test eax, eax
je 0x40546a
push 2
pop eax
jmp 0x405529
call fcn.0040393e
cmp dword [0x446ce0], ebx
jne 0x4054fe
push 5
push dword [0x42b9e4]
call dword [sym.imp.USER32.dll_ShowWindow]
push str.RichEd20
jmp section..htext
push ebx
call fcn.004049df
test eax, eax
je 0x405520
cmp dword [0x442bd4], ebx
jne 0x405462
push 2
call fcn.0040141a
jmp 0x405462
push 1
call fcn.0040141a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret