joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30001b8d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x30001bc3
jle 0x30001c24
and eax, 0xffff
or eax, 0x80070000
jmp 0x30001c24
cmp dword [ebp + 0x10], edi
push esi
je 0x30001c0a
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x30001c0a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jle 0x30001c06
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x30001c23
mov eax, dword [ebp + 0x14]
cmp eax, edi
jne 0x30001c1c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30001c21
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
pop esi
pop edi
leave
ret 0x10

Function at 0x30001c29
Capabilities:
Packed with generic packer
Set registry value

Disassembly:
push esi
push dword [esp + 0x10]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x14]
push 1
jmp loc.300234b3

Function at 0x30001c68
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [section..cdata]
push esi
mov dword [ebp + 0x19c], eax
lea eax, [ebp - 0x74]
push eax
push 0x2000e
xor esi, esi
push esi
push dword [ebp + 0x1ac]
push dword [ebp + 0x1a8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x30001cb9
jle fcn.30001d3d
and eax, 0xffff
or eax, 0x80070000
jmp loc.300232a9
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
jmp 0x30001cd5
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
call fcn.30001c68
mov edi, eax
cmp edi, esi
jne 0x30001d20
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x105
call ebx
test eax, eax
je 0x30001cc3
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x1ac]
push dword [ebp + 0x1a8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
jle 0x30001d3b
and eax, 0xffff
or eax, 0x80070000
jmp 0x30001d3b
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jle 0x30001d39
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop ebx
Function at 0x30002101
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
or esi, 0xffffffff
call fcn.30001e4d
test eax, eax
je 0x30002114
int3
xor edi, edi
push edi
call fcn.30004930
test eax, eax
je fcn.300021d9
call fcn.30004996
test eax, eax
je fcn.300021d9
mov edx, dword [ebp + 8]
cmp edx, 2
mov ecx, dword [ebp + 0xc]
jl 0x30002152
mov eax, dword [ecx + 4]
mov ax, word [eax]
cmp ax, 0x2d
je 0x30002152
cmp ax, 0x2f
jne 0x300021d4
cmp edx, 3
jg 0x300021d4
cmp edx, 2
jl 0x300021d4
mov eax, dword [ecx + 4]
movzx eax, word [eax + 2]
sub eax, 0x61
je 0x300021c8
sub eax, 5
je 0x300021b1
sub eax, 3
je 0x300021a9
sub eax, 0xa
je 0x30002185
dec eax
je 0x30002181
dec eax
jne 0x300021d4
push 1
jmp 0x300021aa
push edi
push edi
jmp 0x300021cb
lea eax, [ebp - 4]
push eax
call fcn.30001d53
test eax, eax
jl 0x3000219f
push esi
push dword [0x300080d0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call fcn.30001dff
jmp 0x300021d2
push edi
call fcn.300020c2
jmp 0x300021d2
cmp edx, 3
jne 0x300021c1
push dword [ecx + 8]
call sub.MSVCRT.dll__wtol
pop ecx
jmp 0x300021c3
xor eax, eax
push eax
push edi
push edi
jmp 0x300021cd
push edi
push 1
push 1
call fcn.300035e9
xor esi, esi
jmp loc.30023c41

Function at 0x30002221
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x3000224f
xor eax, eax
jmp 0x30002277
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x3000226c
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x3000227c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 4
Function at 0x30002322
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..cdata]
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], eax
mov esi, 0x104
lea eax, [ebp - 0x20c]
je 0x3000235f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp eax, edi
je 0x30002357
cmp eax, esi
jbe 0x30002373
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x3000236f
push 1
push 0x1c
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x30002373
xor eax, eax
jmp 0x300023d4
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x30001450
call fcn.30004ba2
cmp dword [ebp + 8], edi
jne 0x300023a2
push 0x30001478
lea eax, [ebp - 0x20c]
push eax
call fcn.30002293
test eax, eax
je 0x300023a2
xor edi, edi
inc edi
push 0x3000148c
lea eax, [ebp - 0x20c]
push eax
call fcn.30002293
test eax, eax
je 0x300023ba
or edi, 2
push 0x300014a0
lea eax, [ebp - 0x20c]
push eax
call fcn.30002293
test eax, eax
je 0x300023d2
or edi, 4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.300063f9
leave
ret 4

Function at 0x30002406
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..cdata]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x3000246b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x30002462
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop ebx
call fcn.300063f9
leave
ret

Function at 0x300025fb
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3e8]
sub esp, 0x468
mov eax, dword [section..cdata]
push esi
push edi
mov dword [ebp + 0x3e4], eax
push 0x10
xor eax, eax
pop ecx
push dword [ebp + 0x3f0]
mov dword [ebp - 0x80], 0x44
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.30004a52
cmp eax, 0x104
jg 0x3000269a
push dword [ebp + 0x3f4]
lea eax, [ebp - 0x2c]
push 0x6b
push dword [ebp + 0x3f0]
push 0x300015f0
push 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x4000020
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x3000269a
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x3e4]
pop edi
pop esi
call fcn.300063f9
add ebp, 0x3e8
leave
ret 8
Function at 0x30002b6c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
cmp ebx, edi
jbe 0x30002bb0
push esi
mov esi, dword [esp + 0x10]
add esi, 4
cmp dword [esi - 4], edi
je 0x30002ba3
mov eax, dword [esi + 8]
sub eax, edi
je 0x30002ba1
dec eax
je 0x30002b95
dec eax
je 0x30002b95
dec eax
jne 0x30002ba3
mov eax, dword [esi]
cmp eax, edi
je 0x30002ba3
push eax
jmp 0x3002371a
mov dword [esi], edi
mov dword [esi - 4], edi
mov dword [esi + 4], edi
add esi, 0x18
dec ebx
jne 0x30002b80
pop esi
pop edi
pop ebx
ret 8

Function at 0x30002bb5
Capabilities:
Packed with generic packer
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x30002bde
xor eax, eax
jmp 0x30002c3f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jne 0x30002bda
cmp dword [ebp - 4], ebx
jne 0x30002bfa
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
xor eax, eax
inc eax
jmp 0x30002c3f
push 0x106
push dword [ebp - 4]
call fcn.300048d1
cmp eax, ebx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
je 0x30002bda
mov eax, dword [ebp - 4]
push edi
mov edi, dword [ebp + 0x14]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
jmp 0x300234f1
pop esi
pop ebx
leave
ret 0x14

Function at 0x30002c45
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
mov edx, dword [esp + 8]
je 0x30002c55
test edx, edx
jne 0x30002c65
xor eax, eax
jmp 0x300238b5
ret 8
cmp al, byte [edx]
jne 0x30002c73
inc ecx
inc edx
mov al, byte [ecx]
test al, al
jne 0x30002c5f
mov al, byte [edx]
neg al
sbb eax, eax
jmp 0x30002c5c
movsx eax, byte [ecx]
movsx ecx, byte [edx]
sub eax, ecx
jmp 0x30002c5c

Function at 0x30002ccd
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [esp + 8], 0x7fffffff
jmp loc.30023de5
Function at 0x30002f3a
Capabilities:
Create process on windows
Packed with generic packer

Disassembly:
push ebp
lea ebp, [esp - 0x5f4]
sub esp, 0x674
mov eax, dword [section..cdata]
push ebx
push esi
mov esi, dword [ebp + 0x600]
push edi
mov dword [ebp + 0x5f0], eax
push 0x10
xor eax, eax
pop ecx
mov dword [ebp - 0x80], 0x44
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
neg esi
sbb esi, esi
push 0x300016a0
stosd dword es:[edi], eax
and esi, 0x3a980
call fcn.300025bc
test eax, eax
je 0x30003047
cmp esi, ebx
jbe fcn.30002fa7
cmp dword [ebp + 0x600], ebx
je fcn.30002fa7
push esi
jmp loc.30023800

Function at 0x30003061
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..cdata]
and word [ebp - 0x20c], 0
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.30002ce3
test eax, eax
pop edi
je fcn.300030b3
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
jmp loc.30023be7

Function at 0x300030bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0xc]
shl esi, 2
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.30003653
test eax, eax
je 0x3000325b
mov ecx, esi
mov edx, ecx
push ebx
shr ecx, 2
push edi
mov edi, dword [ebp - 0xc]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 0xc], ebx
rep stosb byte es:[edi], al
mov dword [ebp - 0x14], esi
jle 0x30003251
mov edi, dword [ebp + 8]
add edi, 0x10
mov dword [ebp - 0x10], edi
cmp dword [edi - 0x10], ebx
jmp loc.30023e57
push dword [ebp - 0xc]
call fcn.3000374e
pop edi
pop ebx
pop esi
leave
ret 0xc

Function at 0x300033da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.300032a4
test eax, eax
je 0x3000344b
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3000344b
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x30001758
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30003441
cmp dword [ebp - 0x10], 1
je 0x30003441
and word [esi], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc
Function at 0x30003653
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
push ebx
lea ebx, [eax + 1]
push edi
mov edi, dword [esp + 0xc]
and ebx, 0xfffffffe
test eax, eax
mov dword [edi], 0
jge 0x3000367a
mov dword [edi], 0
pop edi
xor eax, eax
pop ebx
ret 8
mov eax, dword [0x30008060]
push ebp
push esi
push eax
call sub.KERNEL32.dll_TlsGetValue
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x300036f8
push 1
push 0x2000
push 0x10000
push 0
call ebp
mov esi, eax
test esi, esi
je 0x300036c9
push 4
push 0x1000
push 0x1000
push esi
call ebp
test eax, eax
jne 0x300036dd
push 0x8000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0xe004000e
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
ret 8
mov ecx, dword [0x30008060]
push esi
push ecx
call sub.KERNEL32.dll_TlsSetValue
lea edx, [esi + 0x1000]
lea eax, [esi + 8]
mov dword [esi + 4], edx
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
add ecx, ebx
cmp ecx, eax
jbe 0x3000373a
mov edx, eax
sub edx, esi
lea edi, [edx + ebx + 0xfff]
and edi, 0xfffff000
cmp edi, 0x10000
jg 0x300036c9
push 4
mov ecx, edi
sub ecx, eax
push 0x1000
add ecx, esi
push ecx
push eax
call ebp
test eax, eax
je 0x300036c9
add edi, esi
mov dword [esi + 4], edi
mov edi, dword [esp + 0x14]
mov eax, dword [esi]
mov dword [edi], eax
add eax, ebx
mov dword [esi], eax
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret 8

Function at 0x300038ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
movzx eax, word [esi]
add eax, esi
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor edi, edi
cmp eax, esi
mov ebp, esi
je 0x30003927
mov edx, dword [0x300200f0]
cmp eax, ebp
jne 0x300038e3
movzx ecx, byte [pe_dos_header]
test ecx, ecx
je 0x30003927
test dl, 1
je 0x300038fd
mov ecx, eax
and cl, 7
neg cl
mov ebx, edx
sbb ecx, ecx
add ecx, 1
and ebx, 2
xor ecx, ebx
je 0x30003907
movzx ecx, word [eax + 2]
cmp ecx, dword [esp + 0x1c]
jge 0x30003959
mov dword [esp + 0x18], eax
movzx eax, word [eax]
xor ecx, ecx
add eax, esi
test edi, edi
sete cl
mov edi, ecx
test edi, edi
je 0x30003923
movzx ebp, word [ebp]
add ebp, esi
cmp eax, esi
jne 0x300038d4
mov ax, word [esi + 6]
cmp ax, 0xfffe
je 0x30003950
movzx eax, ax
cmp word [eax*2 + 0x300080e8], 5
jne 0x30003950
push eax
call fcn.300051f3
add esp, 4
test eax, eax
jne 0x300038c2
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x30003a5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test byte [0x300200f0], 1
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jne 0x30003a8b
mov cx, word [eax]
test cx, cx
je 0x30003a8b
movzx ecx, cx
add ecx, eax
movzx ecx, word [ecx + 2]
push esi
lea esi, [edx + 4]
cmp ecx, esi
pop esi
jae 0x30003a98
cmp ecx, edx
je 0x30003a98
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp fcn.300038ac
ret
Function at 0x30003da4
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x30003ead
cmp dword [0x300080e0], 0
jne 0x30003ead
push esi
push 0x300200f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x300080dc]
mov esi, dword [esp + 0x14]
and dword [esp + 0xc], 0x80000000
push 0x300037c6
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], esi
call fcn.30004e9f
test eax, eax
je 0x30003e6b
mov eax, dword [0x300080dc]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x18]
mov edi, dword [ecx + edx*8 + 4]
lea eax, [ecx + edx*8]
mov ecx, dword [eax]
sub esi, ecx
add esi, 0xfff
and esi, 0xfffff000
and edi, 0x7fffffff
sub edi, esi
je 0x30003e39
push 0x4000
push edi
lea eax, [esi + ecx]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [0x300080dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [esp + 0x18]
jmp loc.30023a8b
lea eax, [esi + edi + 3]
and al, 0xfc
lea ecx, [esi + 3]
and ecx, 0xfffffffc
sub eax, ecx
cmp eax, 4
jge 0x30003e93
push 0x300200f8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop edi
add esp, 8
ret
push eax
push ecx
call fcn.30003b96
push 0x300200f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop edi
add esp, 8
ret
xor eax, eax
pop edi
add esp, 8
ret

Function at 0x30003eb4
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [edx*4 + 0x300100e8]
mov ax, word [esi + 2]
test ax, ax
push edi
movzx edi, word [esi + 4]
lea ecx, [edi + ebp + 4]
je 0x30003ee1
movzx eax, ax
movzx eax, word [eax + esi + 2]
sub ecx, eax
cmp ecx, 0xfffc
ja 0x30003f76
mov eax, dword [esp + 0x18]
push eax
push ecx
push edx
call fcn.30003a99
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x30003f76
mov ax, word [esi + 2]
test ax, ax
je 0x30003f12
movzx eax, ax
add eax, esi
jmp 0x30003f22
mov dx, word [esi]
lea eax, [edi + esi]
mov word [eax], dx
mov word [esi + 2], ax
mov word [esi], ax
movzx edx, ax
sub ecx, edx
mov esi, ecx
movzx ecx, si
mov word [eax + 2], si
mov word [ecx + eax - 2], si
mov ecx, dword [0x300200f0]
test cl, 1
jne 0x30003f4f
jmp 0x30023189
mov edx, eax
and dl, 7
neg dl
sbb edx, edx
add edx, 1
and ecx, 2
xor edx, ecx
je 0x30003f6b
xor ecx, ecx
cmp esi, ebp
setge cl
jmp 0x30003f72
xor ecx, ecx
cmp esi, ebp
setg cl
test ecx, ecx
jne 0x30003f79
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
Function at 0x30004697
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [eax]
push esi
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x300046cd
lea ecx, [ebx + 3]
lea edx, [esi + 3]
and ecx, 0xfffffffc
and edx, 0xfffffffc
cmp ecx, edx
jl 0x300046d9
sub ebx, esi
push ebx
add ebp, esi
push ebp
call fcn.30003da4
add esp, 8
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push ebp
call fcn.30003963
add esp, 4
test eax, eax
jne 0x300046ed
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp word [eax + 6], 0xffff
push edi
jne 0x3000478d
mov edx, dword [0x300080dc]
push 0x300037ba
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.30004e9f
test eax, eax
je 0x3000478d
mov ecx, dword [0x300080dc]
mov edx, dword [ecx + 0xc]
mov ecx, dword [esp + 0x24]
mov edx, dword [edx + ecx*8 + 4]
lea eax, [esi + 0xc]
and edx, 0x7fffffff
cmp edx, eax
jae 0x300047d9
push 4
lea edi, [eax + 0xfff]
mov eax, dword [esp + 0x14]
push 0x1000
and edi, 0xfffff000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x3000478d
mov ecx, dword [0x300080dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx + eax*8 + 4]
lea eax, [edx + eax*8 + 4]
xor ecx, edi
pop edi
pop esi
and ecx, 0x7fffffff
xor dword [eax], ecx
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x28]
push edx
lea eax, [esp + 0x28]
push esi
push eax
call fcn.30003f7d
add esp, 0xc
test eax, eax
jne 0x300047ac
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ebx, esi
mov ecx, ebx
jl 0x300047b4
mov ecx, esi
jmp loc.30023d4f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x30004858
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jl 0x3000489e
push 0x300200f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push esi
push ecx
push edx
jmp loc.30023bbc
xor eax, eax
pop esi
ret 0x10

Function at 0x300048d1
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jl 0x300048f1
jmp loc.30023151
xor eax, eax
pop esi
ret 8

Function at 0x300049cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x300049ff
cmp byte [eax], 0
je 0x30004a43
lea eax, [eax + 1]
test eax, 3
je 0x300049ff
cmp byte [eax], 0
je 0x30004a43
lea eax, [eax + 1]
test eax, 3
je 0x300049ff
cmp byte [eax], 0
je 0x30004a43
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x300049ff
test cl, cl
lea eax, [eax - 4]
je 0x30004a43
test ecx, 0xff00
lea eax, [eax + 1]
je 0x30004a43
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x30004a43
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x30004a43
lea eax, [eax + 1]
jmp 0x300049ff
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x30004a52
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x30004a79
cmp word [eax], 0
je 0x30004a72
lea eax, [eax + 2]
test eax, 3
je 0x30004a79
jmp 0x30004a60
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30004ab4
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x30004a79
jmp 0x30023cf5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x30004ac0
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.30004a52
mov ecx, dword [esp + 0x14]
add eax, 1
cmp ecx, eax
jb 0x30004af2
lea esi, [eax + eax]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call sub.MSVCRT.dll_memmove
add esp, 0xc
lea eax, [esi + edi - 2]
pop edi
pop esi
ret 0xc
lea esi, [ecx + ecx - 2]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
jmp loc.30023b66

Function at 0x30004b12
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.300049cb
jmp loc.3002352f

Function at 0x30004ba2
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov eax, dword [esp + 8]
jle 0x30004bc1
lea esp, [esp]
cmp word [eax], 0
je 0x30004bc4
sub ecx, 1
add eax, 2
test ecx, ecx
jg 0x30004bb1
ret 0xc
test ecx, ecx
jle 0x30004bc1
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp fcn.30004ac0

Function at 0x30004c3b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [section..cdata]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], eax
push esi
je 0x30004d71
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x30004d71
push edi
mov edi, dword [ebp + 0x20]
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x400
push eax
mov dword [ebp - 0x40c], 1
mov dword [esi], ebx
jmp loc.300233e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.300063f9
leave
ret 0x1c

Function at 0x30004e3e
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
and word [ecx], 0
push ebx
mov ebx, dword [ecx + 4]
and eax, 0x7fff
mov edx, 0xffff
push esi
mov esi, dword [esp + 0x14]
shl eax, 0x10
and ebx, edx
jmp loc.30023a60