joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3010031a
Capabilities:
Get graphical window text

Disassembly:
push 0xc
mov eax, 0x30194351
call fcn.3010f699
push 8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
push dword [esi + 0xc]
mov dword [ebp - 0x10], esi
call fcn.30059d54
and dword [esi + 0xc], 0
cmp byte [esi + 4], 0
je 0x301003a8
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x3e8
push ebx
push dword [ebp + 8]
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
push 4
inc esi
call fcn.30147180
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push esi
mov ecx, eax
call fcn.3005b59b
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
mov dword [ecx], eax
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.301487a4
mov eax, dword [eax]
push esi
push eax
push ebx
push dword [ebp + 8]
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x18]
call fcn.301490df
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc eax
call fcn.3010f771
ret 4

Function at 0x30102275
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x30024a78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
xor esi, esi
push esi
mov dword [ebp - 0x70], eax
mov eax, dword [ebx + 0xc]
push dword [eax + 0x14]
lea ecx, [ebx + 4]
push dword [eax + 0x18]
push esi
push ecx
call fcn.30101e9e
test eax, eax
je 0x3010230c
cmp dword [ebx + 0x24], esi
jne 0x30102303
push edi
push 0x10
call fcn.30147180
lea ecx, [ebp - 0x6c]
mov dword [ebx + 0x20], eax
call fcn.3014caf1
push 0x10
mov edx, 0x301f828c
lea ecx, [ebp - 0x6c]
call fcn.3014cb1b
push 0x10
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x6c]
call fcn.3014cb1b
lea ecx, [ebp - 0x6c]
call fcn.3014cbc8
mov edi, dword [ebx + 0x20]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x10
pop eax
movsd dword es:[edi], dword [esi]
push dword [ebx + 0x20]
mov dword [ebx + 0x24], eax
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
pop edi
push dword [ebp - 0x70]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x14]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.3010f365
leave
ret 4
Function at 0x30102ec7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x18
mov eax, 0x301944a6
call fcn.3010f699
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
mov al, byte [ebp + 8]
neg al
mov edi, 0x30013228
mov esi, SysReAllocString
mov dword [ebp - 4], ebx
sbb eax, eax
and eax, 0xffffffed
add eax, 0x20019
push eax
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x30102f3d
cmp byte [ebp + 8], bl
jne 0x30102f20
cmp dword [ebp - 0x10], ebx
je 0x30102f19
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x30102fe6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x30102f0b
push 0x30014334
lea ecx, [ebp - 0x14]
call fcn.30148a97
cmp byte [ebp + 8], bl
je 0x30102f73
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
setne byte [ebp + 0xb]
jmp 0x30102fc4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x30102fb1
mov eax, dword [ebp - 0x14]
cmp word [eax], bx
je 0x30102f0b
add eax, 0xfffffff8
push eax
call fcn.301471a2
jmp 0x30102f0b
cmp dword [ebp - 0x20], 4
jne 0x30102fc0
cmp dword [ebp - 0x24], 1
mov byte [ebp + 0xb], bl
je 0x30102fc4
mov byte [ebp + 0xb], 1
mov eax, dword [ebp - 0x14]
cmp word [eax], bx
je 0x30102fd5
add eax, 0xfffffff8
push eax
call fcn.301471a2
cmp dword [ebp - 0x10], ebx
je 0x30102fe3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0xb]
call fcn.3010f771
ret 4

Function at 0x30103009
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x3010301a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 8]
mov eax, dword [ecx - 4]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x30103030
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 8]
cmp word [eax], 0
je 0x30103042
add eax, 0xfffffff8
push eax
call fcn.301471a2
mov esi, dword [esi + 4]
cmp word [esi], 0
je 0x30103054
add esi, 0xfffffff8
push esi
call fcn.301471a2
pop esi
ret
Function at 0x30103056
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
push 0xa
push 0x2710
push dword [0x301b6ee0]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x30103077
xor al, al
jmp 0x301030c8
push esi
push edi
push dword [0x301b6ee0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, 2
jbe 0x301030af
push edi
push dword [0x301b6ee0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x301030af
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x301030af
cmp word [eax], 0xfeff
je 0x301030b3
xor al, al
jmp 0x301030c7
shr esi, 1
dec esi
push esi
push 0
add eax, 2
push eax
lea ecx, [ebx + 4]
call fcn.301496a3
mov al, 1
pop esi
pop edi
pop ebx
ret
Function at 0x30103199
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push 0x14
mov eax, 0x301944c9
call fcn.3010f699
mov esi, ecx
lea edi, [esi + 8]
mov ecx, dword [edi]
mov eax, dword [ecx - 4]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x301031bf
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x30025c28]
mov dword [ebp - 0x14], eax
push 0x105
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.301487a4
push dword [eax]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x20]
mov byte [ebp - 0xd], al
call fcn.301490df
cmp byte [ebp - 0xd], bl
jne 0x3010330d
push 0x30014350
lea ecx, [ebp - 0x14]
call fcn.301495e7
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x3010330d
push dword [ebp - 0x14]
mov ecx, edi
call fcn.30148fce
mov eax, dword [esi + 4]
mov eax, dword [eax - 4]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
push ebx
jae 0x301032a6
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3010330d
cmp dword [ebp - 0x18], 2
jne 0x3010330d
mov eax, dword [esi + 4]
push ebx
lea ecx, [ebp - 0x18]
push ecx
add edi, edi
push edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3010330d
cmp dword [ebp - 0x18], edi
je 0x301032f8
jmp 0x3010330d
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push edi
push eax
push ebx
push ebx
call fcn.30148bb1
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.30147180
push ebx
push ebx
push edi
push eax
push 0xffffffffffffffff
push dword [esi + 4]
mov dword [ebp - 0x18], eax
push ebx
push ebx
call fcn.30148bb1
push ebx
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x30103305
cmp dword [ebp - 0x1c], edi
jne 0x30103305
push dword [ebp - 0x18]
call fcn.301471a2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi], 0xffffffff
jmp 0x3010330d
push dword [ebp - 0x18]
call fcn.301471a2
mov eax, dword [ebp - 0x14]
cmp word [eax], bx
je 0x3010331e
add eax, 0xfffffff8
push eax
call fcn.301471a2
call fcn.3010f771
ret

Function at 0x30103324
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov eax, dword [eax - 4]
cdq
sub eax, edx
sar eax, 1
je 0x3010334d
call fcn.30103199
xor eax, eax
push eax
push eax
push eax
push dword [esi + 8]
push 0x30014364
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret
Function at 0x3010334f
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov eax, dword [eax - 4]
cdq
sub eax, edx
sar eax, 1
je 0x30103379
call fcn.30103199
push 5
xor eax, eax
push eax
push eax
push dword [esi + 8]
push 0x300063cc
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret

Function at 0x30103d6e
Capabilities:
Accept command line arguments

Disassembly:
push 0xd4
mov eax, 0x30194542
call fcn.3010f702
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
call fcn.30102ec7
cmp al, bl
mov byte [ebp - 0xe0], al
jne 0x30103de0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0xdc]
call fcn.30148a97
push 1
push ebx
push 0x300024e4
lea ecx, [ebp - 0xdc]
call fcn.301487e7
cmp eax, 0xffffffff
mov eax, dword [ebp - 0xdc]
sete byte [ebp - 0xd5]
cmp word [eax], bx
je 0x30103dd8
add eax, 0xfffffff8
push eax
call fcn.301471a2
cmp byte [ebp - 0xd5], bl
je 0x30103e12
lea ecx, [ebp - 0xd4]
call fcn.3010337b
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xd4]
push edi
push esi
mov dword [ebp - 4], ebx
call fcn.30103ab3
lea ecx, [ebp - 0xd4]
mov bl, al
call fcn.30103470
mov al, bl
jmp 0x30103e14
mov al, 1
call fcn.3010f785
ret 8

Function at 0x3010619a
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x301b5604], 0xffffffff
jne 0x30106226
push ebx
push esi
push edi
movzx edi, word [0x301f85e8]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and dword [0x301f855c], 0
push 1
push 4
mov esi, 0x404
push esi
push 0x30106176
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
cmp dword [0x301f855c], 0
je 0x3010621c
cmp di, si
jne 0x301061fe
cmp bx, 0x804
je 0x30106205
cmp bx, 0xc04
jne 0x30106210
cmp di, 0x804
je 0x3010621c
cmp word [ebp - 4], si
je 0x30106210
cmp bx, si
jne 0x3010621c
mov dword [0x301b5604], 1
jmp 0x30106223
and dword [0x301b5604], 0
pop edi
pop esi
pop ebx
xor eax, eax
cmp dword [0x301b5604], eax
sete al
leave
ret
Function at 0x3010730a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x30024a78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov edx, 0x400
cmp si, dx
mov dword [ebp - 0x108], edi
movzx ecx, si
jb 0x30107344
mov eax, ecx
and eax, 0xffff03ff
or eax, edx
jmp 0x30107347
movzx eax, cx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x114], eax
movzx eax, word [0x301f85e8]
mov dword [ebp - 0x110], eax
movzx eax, si
mov dword [ebp - 0x11c], eax
mov eax, 0x100
cmp edx, eax
mov dword [ebp - 0x10c], eax
ja 0x3010737b
mov dword [ebp - 0x10c], edx
and word [edi], 0
cmp byte [0x301b6fea], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0x104], 0
je 0x301073a6
push edx
push edi
mov edi, dword [ebp + 0xc]
push edi
push ecx
call esi
jmp 0x301073ba
push dword [ebp - 0x10c]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push edi
push ecx
call ebx
test eax, eax
jne 0x3010747b
push dword [ebp + 8]
push edi
call fcn.3010639e
test eax, eax
mov dword [ebp - 0x118], eax
jle 0x3010747b
cmp byte [0x301b6fea], 0
je 0x301073f8
push dword [ebp + 0x14]
movzx eax, word [ebp - 0x114]
push dword [ebp - 0x108]
push edi
push eax
call esi
jmp 0x30107410
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push eax
movzx eax, word [ebp - 0x114]
push edi
push eax
call ebx
test eax, eax
jne 0x3010747b
cmp dword [ebp - 0x118], 1
jle 0x3010747b
push dword [ebp + 0x14]
push dword [ebp - 0x108]
push edi
push dword [ebp + 8]
call fcn.301070f8
test eax, eax
jne 0x3010747b
cmp dword [ebp - 0x118], 2
jle 0x3010747b
cmp byte [0x301b6fea], al
je 0x3010745a
push dword [ebp + 0x14]
movzx eax, word [ebp - 0x110]
push dword [ebp - 0x108]
push edi
push eax
call esi
jmp 0x30107472
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push eax
movzx eax, word [ebp - 0x110]
push edi
push eax
call ebx
movzx eax, word [ebp - 0x110]
jmp 0x30107481
mov eax, dword [ebp - 0x11c]
cmp byte [ebp - 0x104], 0
je 0x301074e8
cmp edi, 0x38
jb 0x30107494
cmp edi, 0x43
jbe 0x301074b0
cmp edi, 0x44
jb 0x3010749e
cmp edi, 0x4f
jbe 0x301074b0
cmp edi, 0x2a
jb 0x301074a8
cmp edi, 0x30
jbe 0x301074b0
add edi, 0xffffffcf
cmp edi, 6
ja 0x301074c8
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push dword [ebp - 0x108]
push eax
call fcn.301070cf
jmp 0x301074dd
push dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push dword [ebp - 0x108]
push eax
call fcn.301043ee
push dword [ebp - 0x108]
call fcn.3014723b
push dword [ebp - 0x108]
call fcn.3014723b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3010f365
leave
ret 0x10
Function at 0x3010a057
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x301b6edc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0x25e
movzx eax, ax
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x3010a0aa
call edi
cmp eax, 0x715
je 0x3010a09d
cmp eax, 0x716
jne 0x3010a0a6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x3010a0dc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
je 0x3010a0a6
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x3010a0a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x3010bd32
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
cmp si, 0xffff
push edi
je 0x3010bdb1
test si, 0x3ff
je 0x3010bdb1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.3010bcb2
test eax, eax
jne 0x3010bdbd
xor ebx, ebx
push ebx
push ebx
movzx edi, si
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x58
push edi
call esi
test eax, eax
jne 0x3010bd7e
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x3010bdbd
push 0x20
lea eax, [ebp - 0x20]
push eax
push 0x58
push edi
call esi
push 3
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], ebx
call fcn.3010bc30
test eax, eax
je 0x3010bd71
mov al, byte [ebp - 0x40]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x3010bdbd
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 0x10]
and dword [eax], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3010f2b1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x30024a7c
push 0x30002484
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x3010f2e6
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x30024a78
push ebx
call edi
test esi, esi
mov dword [0x30024a78], esi
jne 0x3010f34a
mov dword [0x30024a78], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x301b5908], 0x44bf19b1
pop ebx
leave
ret

Function at 0x3010f365
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30024a78]
jne 0x3010fc0f
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x301f8e00], eax
mov dword [0x301f8dfc], ecx
mov dword [0x301f8df8], edx
mov dword [0x301f8df4], ebx
mov dword [0x301f8df0], esi
mov dword [0x301f8dec], edi
mov word [0x301f8e18], ss
mov word [0x301f8e0c], cs
mov word [0x301f8de8], ds
mov word [0x301f8de4], es
mov word [0x301f8de0], fs
mov word [0x301f8ddc], gs
pushfd
pop dword [0x301f8e10]
mov eax, dword [ebp]
mov dword [0x301f8e04], eax
mov eax, dword [ebp + 4]
mov dword [0x301f8e08], eax
lea eax, [ebp + 8]
mov dword [0x301f8e14], eax
mov eax, dword [ebp - 0x320]
mov dword [0x301f8d50], 0x10001
mov eax, dword [0x301f8e08]
mov dword [0x301f8d04], eax
mov dword [0x301f8cf8], 0xc0000409
mov dword [0x301f8cfc], 1
mov eax, dword [0x30024a78]
mov dword [ebp - 0x328], eax
mov eax, dword [0x301b5908]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x301f8d48], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x30024a98
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x301f8d48], 0
jne 0x3010fcff
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x30127fee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
test byte [esi + 0x48], 0x40
push ebx
movzx ebx, word [esi + 0x52]
push edi
mov edi, eax
je 0x30128000
inc ebx
mov eax, dword [esi]
test eax, eax
je 0x30128010
push eax
push ebx
push dword [edi + 0x3c]
call fcn.3012d143
mov eax, dword [esi + 4]
test eax, eax
je 0x30128021
push eax
push ebx
push dword [edi + 0x70]
call fcn.3012d143
mov eax, dword [esi + 8]
test eax, eax
je 0x30128032
push eax
push ebx
push dword [edi + 0x40]
call fcn.3012d143
test byte [esi + 0x48], 2
je 0x30128051
mov eax, dword [esi + 0xc]
test eax, eax
je 0x301280a5
call fcn.30127899
push dword [esi + 0xc]
push dword [edi + 0x20]
call fcn.3011a8e8
jmp 0x301280a5
movzx ebx, word [esi + 0x18]
test ebx, ebx
jle 0x3012808c
mov eax, dword [esi + 0xc]
test eax, eax
je 0x3012806a
push eax
push ebx
push dword [edi + 0x7c]
call fcn.3012d143
mov eax, dword [esi + 0x10]
test eax, eax
je 0x3012807b
push eax
push ebx
push dword [edi + 0x78]
call fcn.3012d143
mov eax, dword [esi + 0x14]
test eax, eax
je 0x3012808c
push eax
push ebx
push dword [edi + 0x74]
call fcn.3012d143
movzx eax, word [esi + 0x30]
test eax, eax
jle 0x301280a5
push eax
push dword [edi + 0xdc]
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.3013c01f
mov eax, dword [esi + 0x34]
test eax, eax
je 0x301280b5
push eax
push dword [edi + 0x34]
call fcn.3011a8e8
mov eax, dword [esi + 0x38]
test eax, eax
je 0x301280c5
push eax
push dword [edi + 0x38]
call fcn.3011a8e8
push esi
push dword [edi + 0x18]
call fcn.3011a8e8
mov eax, dword [ebp + 8]
pop edi
pop ebx
pop ebp
ret 4
Function at 0x301280d7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x301280f1
push eax
movzx eax, word [esi + 0x4c]
push eax
push dword [edi + 0x3c]
call fcn.3012d143
mov eax, dword [esi + 4]
test eax, eax
je 0x30128106
push eax
movzx eax, word [esi + 0x4c]
push eax
push dword [edi + 0x70]
call fcn.3012d143
mov eax, dword [esi + 8]
test eax, eax
je 0x3012811b
push eax
movzx eax, word [esi + 0x4c]
push eax
push dword [edi + 0x40]
call fcn.3012d143
test byte [esi + 0x48], 2
je 0x3012813a
mov eax, dword [esi + 0xc]
test eax, eax
je 0x30128190
call fcn.30127899
push dword [esi + 0xc]
push dword [edi + 0x20]
call fcn.3011a8e8
jmp 0x30128190
push ebx
movzx ebx, word [esi + 0x18]
test ebx, ebx
jle 0x30128176
mov eax, dword [esi + 0xc]
test eax, eax
je 0x30128154
push eax
push ebx
push dword [edi + 0x7c]
call fcn.3012d143
mov eax, dword [esi + 0x10]
test eax, eax
je 0x30128165
push eax
push ebx
push dword [edi + 0x78]
call fcn.3012d143
mov eax, dword [esi + 0x14]
test eax, eax
je 0x30128176
push eax
push ebx
push dword [edi + 0x74]
call fcn.3012d143
movzx eax, word [esi + 0x30]
test eax, eax
pop ebx
jle 0x30128190
push eax
push dword [edi + 0xdc]
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.3013c01f
mov eax, dword [esi + 0x34]
test eax, eax
je 0x301281a0
push eax
push dword [edi + 0x34]
call fcn.3011a8e8
mov eax, dword [esi + 0x38]
test eax, eax
je 0x301281b0
push eax
push dword [edi + 0x38]
call fcn.3011a8e8
push esi
push dword [edi + 0x1c]
call fcn.3011a8e8
mov eax, dword [ebp + 8]
pop edi
pop ebp
ret 4