joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30d4370
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x30d4471
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x30d4471
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x30d43ba
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x30d43c1
inc edi
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp ebp, edi
jne 0x30d43a0
jmp 0x30d43c3
mov esi, 0x1505
jmp 0x30d43c3
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x30d4471
mov eax, edx
xor eax, 1
mov edi, edx
and edi, 0xfffffffe
add edi, edi
sub edi, eax
and edi, esi
mov dword [esp + 0xc], edi
lea eax, [edx - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
xor ebp, ebp
mov dword [esp], edx
jmp 0x30d440f
mov eax, ebp
xor eax, 1
and ebp, 1
lea ebp, [eax + ebp*2]
cmp ebp, edx
jae 0x30d446f
mov eax, dword [esp + 0xc]
add eax, ebp
and eax, dword [esp + 8]
mov edi, dword [esp + 4]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x30d446f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x30d4400
mov eax, dword [ecx + 0xc]
mov ebx, dword [eax + edi*4]
push ebx
call fcn.030dc720
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x30d4400
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x30]
call fcn.030dc740
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x30d4400
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x30d4471
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x30d5710
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x30d5909
mov esi, dword [esp + 0x30]
test esi, esi
je 0x30d5909
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x30d5909
cmp dword [ecx], 0
jne 0x30d5909
push esi
call fcn.030dc720
add esp, 4
test eax, eax
je 0x30d577a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x30d5781
inc ebx
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
mov ecx, edi
cmp eax, ebx
jne 0x30d5760
jmp 0x30d5783
mov edi, 0x1505
jmp 0x30d5783
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x30d5849
mov dword [esp + 4], eax
mov eax, edx
xor eax, 1
mov esi, edx
and esi, 0xfffffffe
add esi, esi
sub esi, eax
and esi, edi
mov dword [esp + 0x10], esi
lea eax, [edx - 1]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
xor ebx, ebx
mov dword [esp], edx
jmp 0x30d57cf
mov eax, ebx
xor eax, 1
and ebx, 1
lea ebx, [eax + ebx*2]
cmp ebx, edx
jae 0x30d5849
mov eax, dword [esp + 0x10]
lea ebp, [ebx + eax]
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x30d584e
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x30d57c0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
call fcn.030dc720
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x30d57c0
push dword [esp + 4]
push ebp
push dword [esp + 0x38]
call fcn.030dc740
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x30d57c0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.030d47a0
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov ebx, dword [esp + 0x34]
mov dword [eax + esi*4], ebx
jmp 0x30d58fc
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x30d588e
call fcn.030d5a00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x30]
jne 0x30d5909
push esi
call fcn.030dc720
add esp, 4
mov edx, esi
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push esi
push edi
push eax
call fcn.030d5920
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x30]
push esi
call fcn.030dc720
add esp, 4
mov ebx, eax
and eax, 1
mov ecx, ebx
xor ecx, 1
lea eax, [ecx + eax*2]
push eax
call dword [0x311e008]
add esp, 4
test eax, eax
je 0x30d5904
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.030dc640
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov ebx, dword [esp + 0x34]
mov dword [eax + ecx*4], ebx
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [ebx], eax
xor eax, eax
jmp 0x30d5909
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x30d6a30
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x30d6bd6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x30d6bcf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x30d6ac5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x30d6bcf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x30d6b3e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x30d6ae0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x30d6a8d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x30d6b80
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x30d6b60
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x30d6a80
jmp 0x30d6b8f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x30d6a80
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x30d6ba0
jmp 0x30d6a80
shl ecx, 0x10
or ecx, edi
jmp 0x30d6bdb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x30d6bf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x30d6c1e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x30d6cbc
not eax
test bl, 1
jne 0x30d6c25
mov edx, ebx
cmp ebx, 1
jne 0x30d6c56
jmp 0x30d6cba
xor eax, eax
jmp 0x30d6cbc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x311bc50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x311bc50]
cmp ebx, 1
je 0x30d6cba
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x311bc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x311bc50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x311bc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x311bc50]
add esi, 2
cmp edx, esi
jne 0x30d6c60
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x30dcd20
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.03113af0
test al, al
je 0x30dcf0e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0310b3f0
test al, al
je 0x30dcf09
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xbe85c8c5
mov dword [esp + 8], 0xeae09ee2
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x30dcda6
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030dcf20
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x30dcd80
mov dword [esp + 4], 0x2ac18f4f
mov dword [esp + 8], 0xe4399641
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x30dcdf6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030dcfa0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x30dcdd0
test esi, esi
je 0x30dcea6
mov dword [esp + 4], 0xf0e0929
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x30dce56
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030dd010
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x30dce30
mov dword [esp + 4], 0x2f917fe1
mov dword [esp + 8], 0x5954400a
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x30dcea6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030dd0a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x30dce80
mov dword [esp + 4], 0x720d0c0f
mov dword [esp + 8], 0x76717073
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x30dcef6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030dd120
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x30dced0
call fcn.030de8d0
test al, al
je 0x30dcf09
call fcn.030e1d40
call fcn.030dfff0
call fcn.03114f70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x30dd420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, ecx
mov edi, dword [esp + 0x6c]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0x1715
mov byte [esp + 6], 0xe
mov dword [esp + 7], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 6
ja 0x30dd48b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x18]
push eax
call fcn.030de240
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 7
jb 0x30dd460
mov dword [esp + 0xc], 0xa0c08f2
mov word [esp + 0x10], 0xe70e
mov dword [esp + 0x12], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 9
ja 0x30dd4eb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x18]
push eax
call fcn.030de1d0
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 0xa
jb 0x30dd4c0
mov dword [esp + 0x18], 0x3234787f
mov dword [esp + 0x1c], 0x3e3a4c40
mov dword [esp + 0x20], 0x3d32344f
mov dword [esp + 0x24], 0x26292231
mov dword [esp + 0x28], 0x56211512
mov dword [esp + 0x2c], 0x244b818b
mov dword [esp + 0x30], 0x23291f26
mov dword [esp + 0x34], 0xdab29c1c
mov dword [esp + 0x38], 0xe4dbdbe1
mov dword [esp + 0x3c], 0xd4d1ebdf
mov dword [esp + 0x40], 0xdb82a5d6
mov dword [esp + 0x44], 0x8ecdf1d1
mov dword [esp + 0x48], 0xc6f6c4c0
mov dword [esp + 0x4c], 0xcac497bd
mov dword [esp + 0x50], 0x8fb1c8c7
mov byte [esp + 0x54], 0x70
mov dword [esp + 0x55], 0
mov byte [esp + 0x59], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x41
ja 0x30dd5b6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.030de160
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x42
jb 0x30dd590
mov ecx, dword [esp + 0x70]
movzx edx, byte [esp + 0x18]
mov eax, edi
test dl, dl
je 0x30dd5db
lea ebx, [esp + 0x19]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x30dd5d0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x30dd5fb
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x30dd5f0
mov ecx, dword [esp + 0x74]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x30dd61b
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x30dd610
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x30dd63b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x30dd630
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x30dd65b
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x30dd650
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x30ddfd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov al, byte [ebp + 8]
mov edi, eax
call fcn.030de8c0
sub esp, 8
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
mov ecx, ebx
sub ecx, 0x25
setge cl
or al, cl
test al, 1
mov eax, edi
jne 0x30de00b
jmp 0x30de010
jmp 0x30de152
movzx ecx, al
mov edi, esi
mov edx, dword [ebp + 0x10]
add edi, edx
add edi, 0xffffffff
mov byte [esi + edx - 1], 0
cmp ecx, 0
jne 0x30de035
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x30de150
cmp ebx, 0xa
jne 0x30de0db
jmp 0x30de040
movzx ecx, al
cmp ecx, 0x64
setae al
test al, 1
jne 0x30de04f
jmp 0x30de088
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
mov al, byte [edx + 0x311c761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x311c760]
mov edi, esi
add edi, 0xffffffff
jmp 0x30de079
mov byte [edi], al
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
jmp 0x30de040
cmp ecx, 0xa
jae 0x30de09e
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x30de0d9
mov edx, ecx
and edx, 0xfffffffd
mov eax, ecx
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 2
or ecx, 2
imul ecx, edx
add ecx, eax
mov al, byte [ecx + 0x311c761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x311c760]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x30de0d9
jmp 0x30de150
cmp ebx, 0x10
sete cl
test cl, 1
jne 0x30de0ea
jmp 0x30de0e8
jmp 0x30de125
movzx eax, al
jmp 0x30de0ef
cmp eax, 0x10
jge 0x30de105
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x30de150
shl eax, 1
mov cl, byte [eax + 0x311c82a]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], cl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x30de150
movzx ecx, al
cmp ecx, 0
jbe 0x30de14c
mov eax, ecx
xor edx, edx
div ebx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebx
mov edi, esi
jmp 0x30de125
mov esi, edi
jmp 0x30de150
jmp 0x30de152
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x30e0000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov esi, dword [0x3123c5c]
mov dword [esp + 0x3c], 0xf345f1a5
mov dword [esp + 0x40], 0xff57fd46
mov dword [esp + 0x44], 0xfb4ef94c
mov dword [esp + 0x48], 0xc7b1c565
mov dword [esp + 0x4c], 0xc3b4c1bd
mov dword [esp + 0x50], 0xcfaecdbc
mov dword [esp + 0x54], 0xcb95c9a0
mov dword [esp + 0x58], 0xd760d57d
mov dword [esp + 0x5c], 0xd365d17c
mov dword [esp + 0x60], 0xdf6ddd63
mov dword [esp + 0x64], 0xdb8cd9b8
mov dword [esp + 0x68], 0x27462578
mov dword [esp + 0x6c], 0x23522151
mov dword [esp + 0x70], 0x2f5e2d5a
mov dword [esp + 0x74], 0x2b4a2953
mov dword [esp + 0x78], 0x379f356b
mov dword [esp + 0x7c], 0x334c3186
mov dword [esp + 0x80], 0x3f453d40
mov dword [esp + 0x84], 0x3b823958
mov dword [esp + 0x88], 0x77a057a
mov dword [esp + 0x8c], 0x3620169
mov dword [esp + 0x90], 0xfbe0d4d
mov dword [esp + 0x94], 0xbbe09b8
mov dword [esp + 0x98], 0x174915b9
mov dword [esp + 0x9c], 0x13b011bd
mov dword [esp + 0xa0], 0x1fb71d57
mov dword [esp + 0xa4], 0x1b6d19a4
mov dword [esp + 0xa8], 0x67156519
mov dword [esp + 0xac], 0x6314611f
mov dword [esp + 0xb0], 0x6f106d1f
mov dword [esp + 0xb4], 0x6b026908
mov dword [esp + 0xb8], 0x773e753f
mov dword [esp + 0xbc], 0x7327712c
mov dword [esp + 0xc0], 0x7f0a7d28
mov dword [esp + 0xc4], 0x7bce7918
mov dword [esp + 0xc8], 0x47ed45ed
mov dword [esp + 0xcc], 0x432241ed
mov dword [esp + 0xd0], 0x4fe34d03
mov dword [esp + 0xd4], 0x4be149eb
mov dword [esp + 0xd8], 0x573f55e3
mov dword [esp + 0xdc], 0x53115130
mov dword [esp + 0xe0], 0x5fec5df4
mov dword [esp + 0xe4], 0x5bef59ef
mov dword [esp + 0xe8], 0xa7d1a509
mov dword [esp + 0xec], 0xa3d3a1d1
mov dword [esp + 0xf0], 0xafd8add5
mov dword [esp + 0xf4], 0xabdca9d8
mov dword [esp + 0xf8], 0xb7c0b5c4
mov dword [esp + 0xfc], 0xb3d2b1c0
mov dword [esp + 0x100], 0xbf1fbdef
mov dword [esp + 0x104], 0xbb1bb916
mov dword [esp + 0x108], 0x872f8536
mov dword [esp + 0x10c], 0x83ff81f7
mov dword [esp + 0x110], 0x8ff18dff
mov dword [esp + 0x114], 0x8bf989fe
mov dword [esp + 0x118], 0x979695ea
mov dword [esp + 0x11c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xe3
ja 0x30e029d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x3c]
push dword [esp + 8]
push eax
call fcn.030e16a0
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x3c], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xe4
jb 0x30e0270
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call esi
mov esi, eax
xor eax, eax
test esi, esi
setne al
xor ebx, ebx
xor edi, edi
jmp dword [eax*4 + 0x311eb70]
pop es
push cs
add eax, eax
Function at 0x30e07d0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov esi, dword [0x3123c5c]
mov dword [esp + 0x38], 0x9705992d
mov dword [esp + 0x3c], 0x930b9512
mov dword [esp + 0x40], 0x8f1a9104
mov dword [esp + 0x44], 0x8bd98d2d
mov dword [esp + 0x48], 0x87d489c5
mov dword [esp + 0x4c], 0x83e285d4
mov dword [esp + 0x50], 0xff5581d8
mov dword [esp + 0x54], 0xfb68fd65
mov dword [esp + 0x58], 0xf765f964
mov dword [esp + 0x5c], 0xf37df57f
mov dword [esp + 0x60], 0xef5cf190
mov dword [esp + 0x64], 0xeb8aed40
mov dword [esp + 0x68], 0xe7b6e9b9
mov dword [esp + 0x6c], 0xe3b2e5b6
mov dword [esp + 0x70], 0xdfbee1a7
mov dword [esp + 0x74], 0xdb43dd77
mov dword [esp + 0x78], 0xd79cd94a
mov dword [esp + 0x7c], 0xd395d598
mov dword [esp + 0x80], 0xcf46d1b0
mov dword [esp + 0x84], 0xcb86cd86
mov dword [esp + 0x88], 0xc7a6c991
mov dword [esp + 0x8c], 0xc352c585
mov dword [esp + 0x90], 0x3faac150
mov dword [esp + 0x94], 0x3b913da1
mov dword [esp + 0x98], 0x37a839a5
mov dword [esp + 0x9c], 0x33ab3583
mov dword [esp + 0xa0], 0x2f7d31bc
mov dword [esp + 0xa4], 0x2b652d61
mov dword [esp + 0xa8], 0x27742963
mov dword [esp + 0xac], 0x2368256b
mov dword [esp + 0xb0], 0x1f462140
mov dword [esp + 0xb4], 0x1ba21dab
mov dword [esp + 0xb8], 0x17a319b4
mov dword [esp + 0xbc], 0x134615a0
mov dword [esp + 0xc0], 0xf9a1170
mov dword [esp + 0xc4], 0xb9d0d95
mov dword [esp + 0xc8], 0x7660995
mov dword [esp + 0xcc], 0x39f05bf
mov dword [esp + 0xd0], 0x7fe9019f
mov dword [esp + 0xd4], 0x7b237def
mov dword [esp + 0xd8], 0x77c97918
mov dword [esp + 0xdc], 0x73fc75ec
mov dword [esp + 0xe0], 0x6ffb71e3
mov dword [esp + 0xe4], 0x6b396df1
mov dword [esp + 0xe8], 0x67376939
mov dword [esp + 0xec], 0x6330652d
mov dword [esp + 0xf0], 0x5f0c6130
mov dword [esp + 0xf4], 0x5b085d0c
mov dword [esp + 0xf8], 0x57365908
mov dword [esp + 0xfc], 0x53f355fb
mov dword [esp + 0x100], 0x4fef51ca
mov dword [esp + 0x104], 0x4bd34dc2
mov dword [esp + 0x108], 0x470b491b
mov dword [esp + 0x10c], 0x4309450b
mov dword [esp + 0x110], 0xbff14112
mov dword [esp + 0x114], 0xbbbabdf6
mov dword [esp + 0x118], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xe3
ja 0x30e0a5d
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x38]
push dword [esp + 4]
push eax
call fcn.030e1910
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x38], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe4
jb case.default.0x30e0a77
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call esi
mov esi, eax
xor eax, eax
test esi, esi
setne al
xor ebx, ebx
jmp dword [eax*4 + 0x311ec70]

Function at 0x30e1d40
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, eax
shr ecx, 0x1f
xor eax, eax
jmp dword [ecx*4 + 0x311f414]