joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491291
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x60db0f
call fcn.0060cc48
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x4913af
mov ecx, dword [ecx + 0xc]
cmp ecx, ebx
jne 0x4912c3
mov ecx, esi
call fcn.004927da
mov eax, ebx
jmp 0x4913b8
cmp ecx, 2
jne 0x4912e4
cmp byte [esi + 0x5f2], 0
jne 0x4912d7
mov byte [esi + 0x5f2], bl
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4912bc
cmp ecx, 0x65
jne 0x4912f2
mov ecx, esi
call fcn.004928f8
jmp 0x4912bc
cmp ecx, 0x66
jne 0x49130c
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x584], eax
sete al
push eax
call fcn.0049389f
jmp 0x4912bc
cmp ecx, 0x191
jne 0x49131d
mov ecx, esi
call fcn.004929ec
jmp 0x4912bc
cmp ecx, 0x96
jne 0x491347
push dword [esi + 0x5b0]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
mov ecx, esi
call fcn.0049233c
jmp 0x4912bc
cmp ecx, 0x1f5
jne 0x49135b
mov ecx, esi
call fcn.00492a58
jmp 0x4912bc
cmp ecx, 0xa0
jne 0x49136d
call fcn.00492b46
jmp 0x4912bc
cmp ecx, 0x68
jne 0x49137e
mov ecx, esi
call fcn.00493612
jmp 0x4912bc
cmp ecx, 0x2bf
jne 0x4913af
push str.https:__www.ijinshan.com_privacy_dubaPrivacy.html
lea ecx, [ebp + 8]
call fcn.00406173
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00471cbf
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x4912bc
and dword [esi + 0x5b4], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cc120
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x4cc130
jmp dword [edx*4 + 0x4cc184]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cbb90
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cb8c0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cc360
push str.TFTP_finished
push 0x617b60
push ecx
call fcn.004aee10
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x694664
push ecx
call fcn.004aed50
add esp, 0xc
mov eax, 0x47
pop ebp
ret

Function at 0x4cc137
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x4cc130
jmp dword [edx*4 + 0x4cc184]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cbb90
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cb8c0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cc360
push str.TFTP_finished
push 0x617b60
push ecx
call fcn.004aee10
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x694664
push ecx
call fcn.004aed50
add esp, 0xc
mov eax, 0x47
pop ebp
ret

Function at 0x4cc140
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x4cc130
jmp dword [edx*4 + 0x4cc184]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cbb90
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cb8c0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cc360
push str.TFTP_finished
push 0x617b60
push ecx
call fcn.004aee10
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x694664
push ecx
call fcn.004aed50
add esp, 0xc
mov eax, 0x47
pop ebp
ret

Function at 0x4cc149
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x4cc130
jmp dword [edx*4 + 0x4cc184]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cbb90
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cb8c0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004cc360
push str.TFTP_finished
push 0x617b60
push ecx
call fcn.004aee10
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x694664
push ecx
call fcn.004aed50
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x225439a7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x4df45252
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x300ef010
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.301374d4
mov eax, dword [0x3002450c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x1ffe
lea eax, [ebp - 0x2002]
push ebx
push eax
mov word [ebp - 0x2004], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x32
call fcn.300f2db4
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x300ef06f
push ebx
push 0x326b3964
call main
mov eax, dword [0x30274424]
cmp eax, 6
jb 0x300ef081
push 2
pop eax
jmp 0x300ef122
cmp byte [0x30274428], bl
je 0x300ef0d9
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
mov eax, dword [0x30274424]
mov ecx, dword [eax*4 + 0x30274434]
mov eax, dword [ecx]
sub esi, dword [0x3027442c]
call dword [eax + 0x14]
neg eax
sbb eax, eax
and eax, 0x4e20
add eax, 0x2710
cmp esi, eax
pop esi
jbe 0x300ef120
mov eax, dword [0x30274424]
imul eax, eax, 0x1c
push dword [eax + 0x300021d0]
push 0x30002308
call main
xor eax, eax
inc eax
jmp 0x300ef122
imul eax, eax, 0x1c
lea ecx, [ebp - 0x2004]
push ecx
push dword [eax + 0x300021bc]
mov byte [0x30274428], 1
call main
test al, al
jne 0x300ef104
push ebx
push 0x32736270
call main
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [0x3027442c], eax
mov eax, dword [0x30274424]
mov ecx, dword [eax*4 + 0x30274434]
mov eax, dword [ecx]
call dword [eax + 0x18]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.30136bd1
leave
ret
Function at 0x300f31ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x3002450c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea ecx, [ebp - 0x42c]
call fcn.300f1eaa
xor ebx, ebx
push ebx
push 0xa
push 0xa
lea eax, [ebp - 0x42c]
push eax
call main
test eax, eax
jne 0x300f3210
push 0x33666630
push 0x30002bf4
call main
cmp dword [ebp - 0x420], ebx
je 0x300f3209
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
call fcn.3010abc5
xor al, al
jmp 0x300f33eb
push esi
push edi
mov edi, 0x206
push edi
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call main
test al, al
jne 0x300f3251
push 0x33666631
push 0x30002adc
jmp 0x300f3290
push edi
lea eax, [ebp - 0x412]
push ebx
push eax
mov word [ebp - 0x414], bx
call sub.MSVCR80.dll_memset
lea eax, [ebp - 0x20c]
push eax
push 0x30002be8
lea eax, [ebp - 0x414]
push esi
push eax
call main
add esp, 0x1c
test eax, eax
jge 0x300f32b5
push 0x33666632
push 0x30002bc0
call main
cmp dword [ebp - 0x420], ebx
je 0x300f32ae
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
call fcn.3010abc5
xor al, al
jmp 0x300f33e9
lea eax, [ebp - 0x42c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
call main
test al, al
jne 0x300f32d8
push ebx
push 0x33666633
call main
cmp dword [ebp - 0x42c], ebx
mov byte [ebp - 0x415], bl
jbe 0x300f33a0
cmp byte [ebp - 0x415], 0
jne 0x300f33a0
mov eax, dword [ebp - 0x420]
and dword [ebp - 0x430], 0
mov esi, ebx
shl esi, 2
add eax, esi
push dword [eax]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x300f3393
test al, 0x10
je 0x300f3393
mov eax, dword [ebp - 0x420]
lea edi, [esi + eax]
push dword [edi]
call main
mov ecx, dword [edi]
mov edx, dword [ebp - 0x420]
lea eax, [ecx + eax*2 - 2]
cmp word [eax], 0x5c
je 0x300f334d
mov ecx, dword [esi + edx]
cmp eax, ecx
je 0x300f334d
dec eax
dec eax
cmp word [eax], 0x5c
jne 0x300f3341
cmp eax, dword [esi + edx]
je 0x300f3393
lea ecx, [ebp - 0x430]
push ecx
add eax, 2
push eax
call fcn.30126c04
cmp eax, 1
jl 0x300f3393
push dword [ebp - 0x430]
call main
test al, al
je 0x300f3393
mov eax, dword [ebp - 0x430]
push eax
push 0x129a
mov dword [0x30276490], eax
call main
mov byte [ebp - 0x415], 1
inc ebx
cmp ebx, dword [ebp - 0x42c]
jb 0x300f32ea
xor edi, edi
xor esi, esi
cmp dword [ebp - 0x42c], edi
jbe 0x300f33ca
mov eax, dword [ebp - 0x420]
lea eax, [eax + esi*4]
cmp dword [eax], edi
je 0x300f33c1
push dword [eax]
call main
pop ecx
inc esi
cmp esi, dword [ebp - 0x42c]
jb 0x300f33ac
cmp dword [ebp - 0x420], edi
je 0x300f33e3
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
call fcn.3010abc5
mov al, byte [ebp - 0x415]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.30136bd1
leave
ret
Function at 0x300f4346
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
push esi
push esi
push esi
push 0x300f4311
push esi
push esi
call dword [sym.imp.kernel32.dll_CreateThread]
cmp eax, esi
jne 0x300f436c
push esi
push 0x35386d6c
call main
xor al, al
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
pop esi
ret

Function at 0x300fa26a
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x8022
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x300036b4
push 4
push esi
push 4
push 0xffffffffffffffff
push 0x3027754c
mov dword [ebp - 4], esi
call main
test eax, eax
jne 0x300fa2a9
push esi
push 0x326b6372
call main
xor al, al
jmp 0x300fa2f9
cmp dword [ebp - 4], esi
je 0x300fa2b6
push esi
call main
jmp 0x300fa2a5
cmp dword [0x30276470], 1
jne 0x300fa2c3
mov al, 1
jmp 0x300fa2f9
push edi
push esi
push esi
push esi
push 4
push dword [0x3027754c]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp eax, esi
je 0x300fa2f1
mov edi, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
cmp edi, esi
je 0x300fa2f1
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, 1
jmp 0x300fa2f8
call main
xor al, al
pop edi
pop esi
leave
ret

Function at 0x300fa2fc
Capabilities:
Access the windows event log

Disassembly:
push esi
mov esi, dword [sym.imp.advapi32.dll_OpenEventLogW]
push 0x30001dc8
push 0
call esi
test eax, eax
jne 0x300fa32b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 5
je 0x300fa327
push 0
push 0x33346676
call main
xor al, al
pop esi
ret
push edi
mov edi, dword [sym.imp.advapi32.dll_CloseEventLog]
push eax
call edi
push 0x30001de0
push 0
call esi
test eax, eax
jne 0x300fa35d
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 5
je 0x300fa359
push 0
push 0x33766436
call main
xor al, al
jmp 0x300fa362
push eax
call edi
mov al, 1
pop edi
pop esi
ret
Function at 0x300fe1c1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x3002450c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x30004240
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x30004228
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push 0xc6
lea eax, [ebp - 0xfe]
push esi
push eax
mov word [ebp - 0x100], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x64
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.301255f4
mov edi, dword [sym.imp.kernel32.dll_CreateProcessW]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x154]
push eax
push esi
push esi
push 0x4000020
push 1
push esi
push esi
lea eax, [ebp - 0x100]
push eax
mov ebx, 0x30004210
push ebx
call edi
test eax, eax
jne 0x300fe289
push 0x3a98
push dword [ebp - 0x110]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x300fe294
push dword [ebp - 0x110]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x10c]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x300fe294
push esi
push 0x326b667a
call main
push 0x64
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.301255f4
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x154]
push eax
push esi
push esi
push 0x4000020
push 1
push esi
push esi
lea eax, [ebp - 0x100]
push eax
push ebx
call edi
test eax, eax
jne 0x300fe2fd
push 0x3a98
push dword [ebp - 0x110]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x300fe308
push dword [ebp - 0x110]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x10c]
call esi
jmp 0x300fe308
push esi
push 0x326b6730
call main
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.30136bd1
leave
ret

Function at 0x30108b77
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x30108b98
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x30108b98
cmp edx, eax
jb 0x30108b98
add eax, 0x10000
cmp eax, ecx
jae 0x30108bc3
mov eax, dword [0x3022f8cc]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push 0x35636561
call main
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.kernel32.dll_RaiseException]
ret
Function at 0x30123986
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x301239f8
mov eax, dword [ebp + 8]
test eax, 3
je 0x301239b7
cmp word [eax], 0
je 0x301239b0
lea eax, [eax + 2]
test eax, 3
je 0x301239b7
jmp 0x3012399e
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x301239f2
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x301239b7
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x301239f2
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x301239f2
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x301239b7
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x3012b235
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x34
push 0x301f98b0
call fcn.3013765f
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0x28]
mov dword [ebp - 0x30], ecx
mov esi, 0x30021980
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
mov dword [ebx], esi
mov dword [eax], esi
cmp ecx, esi
je 0x3012b275
mov dword [ecx], esi
mov dword [ebx], esi
mov dword [eax], esi
test byte [ebp + 0x24], 8
je 0x3012b2d0
push 0x17
push dword [ebp - 0x2c]
push edx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
je 0x3012b4b6
mov dword [ebp - 4], esi
push edi
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp + 0x24]
xor edx, edx
inc edx
and ecx, edx
mov dword [ebp - 0x2c], ecx
je 0x3012b2dc
cmp eax, dword [ebp + 0x1c]
je 0x3012b2dc
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x3012b4b6
mov dword [eax], edx
jmp 0x3012b4b6
movzx eax, word [ebp + 0x10]
push eax
movzx eax, word [ebp - 0x2c]
push eax
jmp 0x3012b284
cmp eax, 0x200000
ja 0x3012b4b6
mov dword [ebp - 4], edx
push edi
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x44], eax
cmp eax, esi
je 0x3012b4af
push 0xfffffffffffffffe
pop edi
mov dword [ebp - 4], edi
mov dword [ebp - 4], 2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov dword [ebp - 0x34], eax
cmp eax, esi
jne 0x3012b322
mov dword [ebp - 4], edi
jmp 0x3012b4b6
mov dword [ebp - 4], edi
test byte [ebp + 0x24], 2
je 0x3012b3bd
cmp dword [0x3027eab0], esi
jne 0x3012b352
push 0xa
lea eax, [ebp - 0x28]
push eax
push esi
call main
mov dword [0x3027eaac], eax
mov dword [0x3027eab0], 1
mov dword [ebp - 4], 3
mov edi, dword [ebp - 0x40]
push edi
push dword [ebp - 0x34]
push dword [0x3027eaac]
call main
cmp eax, dword [ebp + 0x20]
je 0x3012b386
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x3012b4af
mov dword [eax], 2
jmp 0x3012b4af
mov dword [ebp - 4], 0xfffffffe
jmp 0x3012b3c0
mov edi, dword [ebp - 0x40]
test byte [ebp + 0x24], 4
je 0x3012b43c
mov dword [ebx], esi
mov eax, dword [ebp - 0x38]
mov dword [eax], esi
cmp edi, esi
je 0x3012b446
push edi
push esi
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebx], eax
cmp eax, esi
jne 0x3012b3fe
cmp dword [ebp - 0x2c], esi
je 0x3012b4b6
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x3012b4b6
mov dword [eax], 1
jmp 0x3012b4b6
mov dword [ebp - 4], 4
push edi
push dword [ebp - 0x34]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x3012b441
mov eax, dword [ebp - 0x34]
mov dword [ebx], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], edi
xor eax, eax
inc eax
jmp 0x3012b4b8
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.301376a7
ret
Function at 0x30136bd1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3002450c]
jne 0x3013790a
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3027f418], eax
mov dword [0x3027f414], ecx
mov dword [0x3027f410], edx
mov dword [0x3027f40c], ebx
mov dword [0x3027f408], esi
mov dword [0x3027f404], edi
mov word [0x3027f430], ss
mov word [0x3027f424], cs
mov word [0x3027f400], ds
mov word [0x3027f3fc], es
mov word [0x3027f3f8], fs
mov word [0x3027f3f4], gs
pushfd
pop dword [0x3027f428]
mov eax, dword [ebp]
mov dword [0x3027f41c], eax
mov eax, dword [ebp + 4]
mov dword [0x3027f420], eax
lea eax, [ebp + 8]
mov dword [0x3027f42c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3027f368], 0x10001
mov eax, dword [0x3027f420]
mov dword [0x3027f31c], eax
mov dword [0x3027f310], 0xc0000409
mov dword [0x3027f314], 1
mov eax, dword [0x3002450c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x30260ab4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x3027f360], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x300247f0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x3027f360], 0
jne 0x301379fa
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x3013747b
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x301fa490
call fcn.301376d6
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x3027f948
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x3013721a
cmp eax, esi
jne 0x3013720d
xor esi, esi
inc esi
mov ebx, esi
jmp 0x3013721d
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x301371f4
xor esi, esi
inc esi
mov eax, dword [0x3027f944]
cmp eax, esi
jne 0x30137230
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x3013725f
mov eax, dword [0x3027f944]
test eax, eax
jne 0x30137259
mov dword [0x3027f944], esi
push 0x300019b4
push 0x300019a8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x3013725f
jmp 0x30137387
mov dword [0x3027f308], esi
mov eax, dword [0x3027f944]
cmp eax, esi
jne 0x30137283
push 0x300019a4
push 0x300018f8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3027f944], 2
test ebx, ebx
jne 0x3013728f
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x3027f954], 0
je 0x301372b3
push 0x3027f954
call fcn.30137acd
pop ecx
test eax, eax
je 0x301372b3
push 0
push 2
push 0
call dword [0x3027f954]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x3013730f
test al, al
je 0x301372cd
cmp dword [ebp - 0x1c], 0
jne 0x3013730f
mov al, byte [esi]
test al, al
je 0x301372dd
cmp al, 0x20
ja 0x301372dd
inc esi
mov dword [ebp - 0x20], esi
jmp 0x301372cd
test byte [ebp - 0x3c], 1
je 0x301372e9
movzx eax, word [ebp - 0x38]
jmp 0x301372ec
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x3027f304], eax
cmp dword [0x3027f2f8], 0
jne 0x30137363
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x3013731e
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30137331
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x301372ba
cmp dword [0x3027f308], 0
jne 0x30137372
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3027f304]
jmp 0x30137393
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.3013771b
ret
call main
jmp 0x301371ba
Function at 0x3013e752
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x30159393
Capabilities:
Get thread local storage value

Disassembly:
push dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x301593a4
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x3015948e
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x3027f6c0], 0
jbe 0x301594a0
inc dword [0x3027f6c0]
xor eax, eax
ret
call fcn.301ac336
call fcn.301ac10c
test eax, eax
jne 0x301594b4
mov eax, 0x80004005
ret
push esi
mov dword [0x30261bd8], 2
mov dword [0x30261bdc], 0x8d
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot], eax
jne 0x301594e0
mov esi, 0x80040001
jmp 0x30159525
call fcn.30164f8f
call fcn.301abf99
mov esi, eax
test esi, esi
jl 0x30159525
call fcn.30153509
mov esi, eax
test esi, esi
jl 0x30159525
call fcn.3019a85a
mov esi, eax
test esi, esi
jl 0x30159525
call sym.OFFDIAG.exe_public_virtual:_enum_NetUI::NetUIControlType___thiscall_NetUI::Element::GetCtrlType_void_
mov esi, eax
test esi, esi
jl 0x30159525
push 0x3027f6c4
push 0x40
push 0x18
call main
mov esi, eax
test esi, esi
jge 0x3015954b
call fcn.301abe6b
call fcn.30153c33
mov eax, dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot]
cmp eax, 0xffffffff
je 0x30159547
push eax
call dword [sym.imp.kernel32.dll_TlsFree]
or dword [sym.OFFDIAG.exe_unsigned_long_int_NetUI::g_dwElSlot], 0xffffffff
mov eax, esi
pop esi
ret
mov dword [0x3027f6c0], 1
xor eax, eax
pop esi
ret