joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30027abc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDC]
push dword [0x300967d0]
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x30027afa
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
push dword [ebp - 4]
call fcn.30067a6d
mov edi, dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, eax
test ebx, ebx
jne 0x30027bb6
lea eax, [ebp - 0x34]
push eax
push 0x18
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jne 0x30027bb6
push dword [ebp - 0x2c]
xor ebx, ebx
push dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
push esi
call dword [sym.imp.GDI32.dll_SaveDC]
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.30026a7d
test eax, eax
je 0x30027b5f
push ebx
push esi
call fcn.30067de7
push 2
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
push dword [ebp - 0xc]
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, 0x96
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 4
push 4
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push esi
push dword [ebp + 8]
call edi
push ebx
push 1
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push dword [ebp + 0xc]
xor esi, esi
push eax
push 6
push dword [ebp + 8]
call fcn.30026d7b
mov ebx, eax
test esi, esi
je 0x30027bc0
push esi
push dword [ebp + 8]
call edi
cmp dword [ebp - 8], 0
je 0x30027bcc
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x30028daf
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
push esi
push edi
push 0x6a
pop edi
jge 0x30028dcf
mov ecx, dword [ebp + 0x18]
neg ebx
mov edx, ebx
jmp 0x30028e14
push 9
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, dword [ebp + 8]
push dword [esi + 0x40]
mov dword [ebp + 0x14], eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x14]
mov dword [ebp + 8], eax
push dword [ebp + 0x18]
push edi
push ebx
push eax
call fcn.3003366f
push dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
imul eax, eax, 0xd0
add esi, eax
mov eax, dword [esi + 0x48]
sub eax, dword [esi + 0x40]
mov ebx, dword [esi + 0x44]
sub ebx, dword [esi + 0x3c]
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x14], ebx
inc edx
fild dword [ebp + 0x18]
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], edx
fld st(0)
fild dword [ebp + 0x14]
fld st(0)
fld1
fld st(0)
fld qword [0x30001610]
fcom st(3)
fnstsw ax
test ah, 5
jp 0x30028e71
fstp st(1)
fld st(0)
fdiv st(3)
fld st(0)
fmulp st(6)
fld st(0)
fmulp st(4)
fxch st(1)
fcom st(5)
fnstsw ax
test ah, 5
jp 0x30028eca
fstp st(3)
fxch st(2)
fdivrp st(4)
fxch st(3)
fmulp st(1)
fmul st(3), st(0)
fmul st(1), st(0)
fxch st(3)
fxch st(2)
fxch st(1)
fxch st(3)
fucompp
fnstsw ax
test ah, 0x44
jnp 0x30028ed2
fxch st(1)
call fcn.30071e75
mov edi, eax
sub edi, ebx
call fcn.30071e75
mov ecx, dword [esi + 0x44]
sub eax, dword [ebp + 0x18]
add dword [esi + 0x34], edi
add dword [esi + 0x38], eax
add dword [esi + 0x24], edi
add ecx, edi
mov dword [esi + 0x44], ecx
mov ecx, dword [esi + 0x48]
add ecx, eax
add dword [esi + 0x28], eax
mov dword [esi + 0x48], ecx
jmp 0x30028ed6
fstp st(0)
fstp st(5)
fstp st(2)
jmp 0x30028e8e
fstp st(1)
fstp st(0)
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x3002d2d1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
and dword [ebp - 4], 0
push 4
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
mov dword [ebp - 0x24], eax
je 0x3002d491
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call edi
mov ebx, eax
push dword [ebx + 0x1d6]
call edi
mov esi, eax
push dword [esi + 0x50]
call edi
push dword [esi + 0x58]
mov dword [ebp - 0x18], eax
call edi
push dword [esi + 0x40]
mov edi, eax
mov dword [ebp - 0x20], edi
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x3c]
push eax
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_LPtoDP]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
movzx eax, al
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [edi + 0x10], eax
mov dword [ebp - 0x10], eax
jle 0x3002d449
add edi, 0x14
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], eax
imul eax, eax, 0xd0
lea edi, [ecx + eax]
mov eax, dword [edi + 0x88]
mov edx, dword [edi + 0x24]
and al, 0x20
xor cl, cl
cmp cl, al
mov ecx, dword [edi + 0x20]
push ecx
mov dword [ebp - 0x2c], edx
mov edx, dword [edi + 0x28]
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x1c]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x3002d3f4
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x3002d3f4
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
jne 0x3002d3f6
cmp dword [ebp - 0x14], ecx
lea eax, [edi + 0x88]
je 0x3002d3ea
xor edi, edi
inc edi
test byte [eax], 1
jne 0x3002d409
push edi
push edi
push eax
call fcn.30067eb7
inc dword [esi + 0x60]
jmp 0x3002d414
test byte [eax], 1
jne 0x3002d431
xor edi, edi
inc edi
jmp 0x3002d3dd
xor ecx, ecx
cmp dword [ebp - 0x14], ecx
jne 0x3002d431
lea eax, [edi + 0x88]
test byte [eax], 1
je 0x3002d431
xor edi, edi
inc edi
push ecx
push edi
push eax
call fcn.30067eb7
dec dword [esi + 0x60]
push 0
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
push edi
push eax
push dword [ebx + 0x1d6]
push 0
push dword [ebp + 8]
call fcn.3002e722
mov dword [ebp - 4], edi
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0xc], 4
cmp ecx, dword [eax + 0x10]
jl 0x3002d368
xor eax, eax
cmp dword [esi + 0x60], eax
jge 0x3002d451
mov dword [esi + 0x60], eax
cmp dword [ebp - 4], eax
je 0x3002d471
push eax
push eax
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0x4000
lea eax, [ebx + 0x22]
push eax
call fcn.30067eb7
push dword [esi + 0x50]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call edi
push dword [esi + 0x58]
call edi
push dword [ebx + 0x1d6]
call edi
push dword [ebp - 0x24]
call edi
pop edi
pop esi
pop ebx
xor eax, eax
leave
ret 8
Function at 0x30032fc2
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x30033057
push esi
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x30033050
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov edi, eax
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
je 0x3003304f
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call esi
push dword [ebp - 4]
mov ebx, eax
call esi
mov dword [ebp + 8], eax
jmp 0x3003303a
mov esi, 0xfa00
cmp edi, esi
jg 0x30033025
mov esi, edi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll_memmove]
add dword [ebp + 8], esi
add esp, 0xc
add ebx, esi
sub edi, esi
test edi, edi
jg 0x3003301a
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 8]
call esi
pop ebx
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x30033a9d
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor esi, esi
push 1
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.30047fcd
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.30030988
mov edi, eax
cmp edi, esi
jne 0x30033c1d
push ebx
push esi
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp + 0x14], eax
call ebx
push 0x408
push 0x42
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp + 0x10], eax
je 0x30033bc3
push eax
call ebx
mov edi, eax
lea eax, [ebp + 0xc]
push eax
mov edx, esi
mov ecx, edi
call fcn.30032b6e
mov eax, dword [ebp + 0xc]
lea eax, [esi + eax*4 + 0x28]
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.GDI32.dll_CreatePalette]
test eax, eax
mov dword [ebp - 8], eax
je 0x30033b53
push 0
push eax
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SelectPalette]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_RealizePalette]
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
push ebx
call fcn.30067a6d
mov edi, eax
test edi, edi
jne 0x30033bb8
push eax
push esi
push dword [ebp + 0xc]
push dword [esi + 8]
push eax
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SetDIBits]
mov edi, eax
neg edi
sbb edi, edi
inc edi
jne 0x30033bb8
push dword [0x300967d0]
mov edi, 0x2714
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x30033bb8
push ebx
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x30033bb2
xor edi, edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
je 0x30033bc3
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebx
cmp dword [ebp + 0x10], 0
je 0x30033be9
push dword [ebp + 0x10]
call esi
push dword [ebp + 0x10]
call ebx
cmp dword [ebp - 8], 0
pop ebx
je 0x30033c10
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_RealizePalette]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp + 0x14]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, edi
pop edi
pop esi
leave
ret 0x10
Function at 0x300376d6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
push ebx
push 4
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x300376fc
xor eax, eax
inc eax
jmp 0x300378a8
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call edi
mov esi, eax
push esi
call fcn.30050b1b
push esi
call fcn.3005d248
lea eax, [ebp + 8]
push eax
push 0x72
push 0x64
push dword [esi + 0x26]
mov dword [0x30085af4], ebx
call fcn.3003a5eb
test eax, eax
jne 0x30037741
push dword [ebp + 8]
call fcn.3004ee74
mov dword [0x30085af4], 1
push 0xfffe
push 2
mov dword [0x30085ab4], ebx
mov dword [0x30085ab8], ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x30085ab4], eax
call fcn.30067a6d
mov ebx, eax
test ebx, ebx
jne 0x3003783c
push dword [0x30085ab4]
call edi
push 0x1002
push dword [ebp + 0xc]
mov dword [0x30085ab0], eax
call fcn.300680ec
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x3003779b
mov ebx, 0x2713
jmp 0x3003783c
mov eax, dword [esi + 0xe6]
xor edi, edi
cmp eax, edi
je 0x300377c3
push eax
call fcn.300383ae
mov ebx, eax
cmp ebx, edi
je 0x300377c3
cmp dword [ebp + 0x10], edi
jne 0x300377be
push ebx
call fcn.30050839
or ebx, 0xffffffff
jmp 0x3003783c
cmp dword [ebp + 0x14], edi
je 0x300377d9
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push esi
call fcn.300359e1
mov ebx, eax
jmp 0x300377e7
push edi
push dword [esi + 0xde]
push edi
push esi
call fcn.300359e1
cmp ebx, edi
jne 0x3003783c
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.3003442f
mov ebx, eax
test ebx, ebx
jne 0x3003783c
mov edi, dword [ebp - 4]
mov ebx, edi
call fcn.30034576
mov ebx, eax
test ebx, ebx
jne 0x3003783c
push edi
call fcn.30035eb9
mov ebx, eax
test ebx, ebx
jne 0x3003783c
push dword [ebp + 0x1c]
mov ecx, edi
push dword [ebp + 0x18]
mov ebx, esi
push dword [ebp + 0x14]
call fcn.300373d0
mov ebx, eax
test ebx, ebx
jne 0x3003783c
mov eax, edi
call fcn.300351bf
mov ebx, eax
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
mov eax, dword [0x30085ab4]
xor edi, edi
cmp eax, edi
je 0x30037867
push eax
call esi
push dword [0x30085ab4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [0x30085ab4], edi
cmp dword [ebp - 4], 0xffffffff
je 0x30037876
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
je 0x3003789c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
inc eax
neg eax
sbb eax, eax
and eax, 6
cmp dword [ebp + 0x10], edi
jne 0x3003789c
cmp eax, edi
je 0x3003789c
push eax
call fcn.30048b2d
push edi
push 2
call fcn.30063f5f
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x18
Function at 0x3003a2ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x30097b90]
push esi
mov esi, dword [ebp + 8]
imul esi, esi, 0xca
push edi
push 0
add eax, esi
mov edi, dword [eax + 0xc]
push 0
push dword [eax + 6]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x3003a2dd
mov eax, 0x2713
jmp 0x3003a312
push 0
lea eax, [ebp + 8]
push eax
mov eax, dword [0x30097b90]
push 0xca
lea eax, [esi + eax + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3003a2d6
mov eax, dword [0x30097b90]
push 0
push 1
lea eax, [esi + eax + 0xa]
push eax
call fcn.30067ede
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x3003a341
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x30097b90]
imul eax, eax, 0xca
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xa]
add eax, ecx
mov ecx, dword [eax + 6]
mov eax, dword [eax + 0xc]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
je 0x3003a3da
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
test ax, 0x4000
je 0x3003a387
inc edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
test eax, eax
jne 0x3003a3a0
test edi, edi
jne 0x3003a3a4
mov eax, 0x2714
jmp 0x3003a4d2
test edi, edi
je 0x3003a3bc
push 2
push dword [esi + 6]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test eax, eax
je 0x3003a396
and dword [ebp - 4], 0
mov ebx, eax
jmp 0x3003a3f2
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [eax + 0xa]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp edi, dword [esi + 6]
je 0x3003a3f2
push 3
pop eax
jmp 0x3003a4d2
push dword [esi + 6]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x3003a396
mov dword [ebp - 0xc], 1
mov eax, dword [esi + 2]
add eax, dword [ebp - 0x10]
push 0
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x3003a417
mov dword [ebp - 4], 0x2713
jmp 0x3003a4b8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
mov edi, eax
mov eax, dword [esi + 6]
lea ecx, [ebp + 8]
push ecx
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3003a40b
mov eax, dword [edi + 6]
cmp eax, dword [esi + 2]
je 0x3003a449
mov dword [ebp - 4], 4
jmp 0x3003a4ab
mov eax, dword [edi + 0xa]
cmp eax, dword [esi + 6]
je 0x3003a45a
mov dword [ebp - 4], 3
jmp 0x3003a4ab
movsx eax, word [edi + 2]
cmp eax, dword [ebp + 0x10]
je 0x3003a46c
mov dword [ebp - 4], 5
jmp 0x3003a4ab
mov ax, word [ebp + 0xc]
mov word [edi + 4], ax
mov al, byte [edi + 0xe]
and al, 8
movzx ax, al
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
mov word [edi + 0xe], ax
jge 0x3003a4ab
cmp dword [ebp - 0xc], ecx
je 0x3003a4ab
cmp word [esi], 0xfffd
je 0x3003a4ab
cmp word [edi + 0x10], cx
jle 0x3003a4ab
lea eax, [edi + 0x1c]
and dword [eax], 0
movsx edx, word [edi + 0x10]
inc ecx
add eax, 0xe
cmp ecx, edx
jl 0x3003a49c
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 4], 0
je 0x3003a4cc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [esi + 0xa], 0
jmp 0x3003a4cf
mov dword [esi + 0xa], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3003accd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x30097b90]
movsx ecx, word [eax]
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
cmp ecx, esi
jle 0x3003acfd
add eax, 0xa
mov ebx, 0xca
cmp word [eax], si
je 0x3003acf9
inc edi
add eax, ebx
cmp edi, ecx
jl 0x3003aceb
jmp 0x3003acfd
cmp edi, esi
jge 0x3003ad05
push 2
pop eax
jmp 0x3003ae85
cmp dword [ebp + 8], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
je 0x3003ad2b
push 2
push dword [ebp + 8]
call fcn.300680ec
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x3003ad2b
mov eax, 0x2713
jmp 0x3003ae85
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x3003ad4a
mov dword [ebp + 0x14], 0x2713
jmp 0x3003ae62
mov esi, edi
imul esi, esi, 0xca
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [0x30097b90]
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esi + eax + 2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3003ad3e
mov eax, dword [0x30097b90]
add eax, esi
cmp word [eax + 2], 2
je 0x3003ad8b
mov dword [ebp + 0x14], 7
jmp 0x3003ae62
mov ecx, dword [ebp + 0x14]
cmp dword [eax + 6], ecx
je 0x3003ad9f
mov dword [ebp + 0x14], 6
jmp 0x3003ae62
cmp word [eax + 4], 0xffff
jne 0x3003ad7f
mov eax, dword [ebp + 0x18]
or dword [eax], 0xffffffff
mov eax, dword [0x30097b90]
lea eax, [esi + eax + 0xa]
mov cl, byte [eax]
and cl, 4
or cl, 8
movzx cx, cl
mov word [eax], cx
mov eax, dword [0x30097b90]
mov dword [esi + eax + 0xc], ebx
mov eax, dword [0x30097b90]
xor ebx, ebx
mov dword [esi + eax + 0x40], ebx
mov eax, dword [0x30097b90]
mov dword [esi + eax + 0x24], ebx
mov eax, dword [0x30097b90]
mov dword [esi + eax + 0x32], ebx
mov eax, dword [0x30097b90]
push 0xfffffffffffffffc
push edi
lea eax, [esi + eax + 0x36]
push eax
call fcn.3003a341
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x3003ae3a
mov eax, dword [0x30097b90]
push dword [esi + eax + 0x40]
call fcn.3004ee74
mov eax, dword [0x30097b90]
push 0xfffffffffffffffc
push edi
lea eax, [esi + eax + 0x1a]
push eax
call fcn.3003a341
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x3003ae3a
mov eax, dword [0x30097b90]
push dword [esi + eax + 0x24]
call fcn.3004ee74
jmp 0x3003ae82
mov eax, dword [0x30097b90]
mov eax, dword [esi + eax + 0x40]
cmp eax, ebx
je 0x3003ae4e
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x30097b90]
mov esi, dword [esi + eax + 0x24]
cmp esi, ebx
je 0x3003ae62
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp + 8], 0
je 0x3003ae71
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x30097b90]
imul edi, edi, 0xca
and word [edi + eax + 0xa], 0
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x3003b9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], ebx
je 0x3003ba9a
push esi
call fcn.30067f0e
test eax, eax
jne 0x3003ba9a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x3003ba9a
cmp eax, 0x10
jae 0x3003b9f5
push 0xd
pop eax
jmp 0x3003ba9d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [esi + 0xe]
test byte [eax], 1
mov dword [ebp - 0xc], eax
je 0x3003ba91
movsx eax, word [esi + 4]
push eax
call fcn.3003b89e
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x3003ba91
movsx eax, word [esi + 4]
mov ecx, dword [0x30097b90]
imul eax, eax, 0xca
push edi
add eax, ecx
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 6]
add eax, dword [esi + 6]
push ebx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x3003ba77
mov ebx, dword [esi + 0xa]
cmp ebx, dword [ebp - 8]
jbe 0x3003ba5a
mov dword [ebp - 4], 0x19
jmp 0x3003ba90
lea eax, [ebp - 8]
push eax
push edi
call fcn.30067e92
push 0
lea eax, [ebp - 4]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x3003ba80
mov dword [ebp - 4], 0x2713
jmp 0x3003ba90
and dword [ebp - 4], 0
push 0
push 1
push dword [ebp - 0xc]
call fcn.30067ede
pop edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x30040c68
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x14], esi
jae 0x30040c7f
mov eax, 0x2713
jmp 0x30040d36
push edi
xor edi, edi
cmp dword [0x30095b08], edi
je 0x30040d0f
mov eax, dword [0x30095b0c]
lea ecx, [eax + esi]
mov ebx, 0xfffe
cmp ecx, ebx
jbe 0x30040cef
mov ecx, dword [0x30095b10]
push edi
push edi
add ecx, eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x30095b10]
mov esi, eax
mov eax, dword [0x30095b0c]
add ecx, eax
cmp esi, ecx
jne 0x30040d25
push edi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [0x30095b04]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x30040d25
xor eax, eax
mov dword [0x30095b10], esi
mov esi, dword [ebp + 0xc]
mov dword [0x30095b0c], eax
mov ecx, dword [0x30095b04]
push esi
add ecx, eax
push ecx
push dword [ebp + 0x10]
call dword [sym.imp.MSVCR80.dll_memmove]
add dword [0x30095b0c], esi
add esp, 0xc
xor eax, eax
jmp 0x30040d35
push edi
lea eax, [ebp + 0x14]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x30040d2c
mov eax, 0x2713
jmp 0x30040d35
xor eax, eax
cmp dword [ebp + 0x14], esi
sete al
dec eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10