joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c716
Capabilities:
Terminate process

Disassembly:
mov esi, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x68]
call fcn.0041da96
call fcn.0041aeb2
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
jmp 0x41c6f5
call fcn.0041da96
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
call fcn.0041da96
call fcn.0041da96
call fcn.0041d550
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.00413e01
push eax
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x68]
call fcn.0041a6da
je 0x41c6f0
mov edi, dword [ebp + edi - 0x6c]
call fcn.0041a6ed
je 0x41c6f0
mov dword [ebp - 0x64], esi
add dword [ebp - 0x64], ecx
cld
push ecx
push esi
call fcn.0041b84b
pop esi
pop ecx
test eax, eax
je 0x41c6f0
push edi
push edx
push ecx
sub ecx, eax
call fcn.0041a67e
jb 0x41c7a3
jecxz 0x41c79b
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop ecx
pop edx
pop edi
call fcn.0041b96e
jb 0x41c791
push ecx
mov ecx, esi
sub ecx, eax
push esi
mov esi, eax
push edi
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
pop ecx
inc esi
or ecx, ecx
jne 0x41c762
jmp 0x41c6d7
mov ecx, dword [ebp - 0x64]
sub ecx, eax
jmp 0x41c6c6
add esp, 0xc
jmp 0x41c6da
add esp, 0xc
jmp 0x41c6fb

Function at 0x41c9f9
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x41ca19
and esi, 0xfffffffe
jne 0x41ca23
xchg dword [ebx], esi
call fcn.0041a6b2
pop edi
pop esi
ret
call fcn.0041a6da
mov edi, dword [ebx]
or edi, edi
je 0x41ca33
cmp ecx, dword [edi - 4]
je 0x41ca53
call fcn.0041a67e
jb 0x41ca63
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.0041a6b2
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.0041a6b2
pop edi
pop esi
jmp fcn.00413e0c

Function at 0x41ca73
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41ca90
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.0041a6da
call fcn.0041a67e
jb 0x41cab2
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.00413e0c
Function at 0x41cabb
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41cadb
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.0041a6da
call fcn.0041a67e
jb 0x41cb00
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.00413e0c

Function at 0x41ccbd
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.0041a6da
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.0041a6da
jecxz 0x41cd33
test ebx, ebx
je 0x41cd3b
add ebx, ecx
xchg ecx, ebx
call fcn.0041a67e
jb 0x41cd48
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.0041a6b2
mov esi, dword [ebp + edi - 0x6c]
call fcn.0041a6b2
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00413e0c

Function at 0x41d3f9
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x41d426
je 0x41d422
shr esi, 1
jae 0x41d447
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.0041a6b2
jmp 0x41d405
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x41d458
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.004147e9
pop ebx
jae 0x41d405
pop esi
pop edx
pop eax
jmp fcn.00413e0c
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x41d405
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x41d405
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x41d405

Function at 0x41dba2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], edi
call fcn.0041e505
jb 0x41dbf7
call fcn.0041dcbf
jb 0x41dbf7
call fcn.0041dcf8
mov eax, dword [ebp - 0xc]
cmp eax, 0x80000
ja 0x41dbeb
call fcn.0041b258
mov dword [ebp - 0x180], esp
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x1c]
dec edx
imul edx, dword [ebp - 0xc]
add edx, ecx
call fcn.0041dc0a
Function at 0x41e137
Capabilities:
Terminate process

Disassembly:
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
pop edx
add esp, 0x3c
push edx
jmp fcn.00413e0c
push ebp
mov ebp, esp
push ebx
sub esp, 0x17c
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], edi
call fcn.0041e1c2
call fcn.0041e505
jb 0x41e1b0
call fcn.0041e4d4
jb 0x41e1b0
call fcn.0041e58e
jb 0x41e1b0
call fcn.0041e1d5
mov esi, dword [ebp - 0x20]
call fcn.0041a6da
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
call dword [ebp - 0x50]
call dword [ebp - 0x54]
jb 0x41e18e
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x2c]
jne 0x41e174
xor edx, edx
jmp 0x41e195
mov edx, dword [ebp + 0x1c]
sub edx, dword [ebp - 0x2c]
inc edx
call fcn.0041e1ba
mov esi, dword [ebp - 4]
mov word [esi], dx
test dword [ebp + 8], 0x100
je 0x41e1ab
mov dword [esi], edx
jmp 0x41dbeb
call fcn.0041e1ba
jmp 0x41dbf7
Function at 0x3025300
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x30f8968]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x302532c
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x3025334
mov eax, dword [ebp - 8]
jmp 0x30254ab
push 0x105
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0303cbb0
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x438]
push edx
call fcn.0306bbba
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
call fcn.0302abd0
test eax, eax
jne 0x3025378
xor eax, eax
jmp 0x30254ab
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0xffffffff
jne 0x30253ad
xor eax, eax
jmp 0x30254ab
push 0
mov edx, dword [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x30253d7
cmp dword [ebp - 0x224], 0x104
jbe 0x30253e1
jmp 0x3025492
push 0x104
push 0
lea eax, [ebp - 0x330]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 0x440]
push ecx
mov edx, dword [ebp - 0x224]
push edx
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x3025423
jmp 0x3025492
mov edx, dword [ebp - 0x440]
cmp edx, dword [ebp - 0x224]
je 0x3025435
jmp 0x3025492
mov dword [ebp - 8], 1
lea eax, [ebp - 0x330]
mov dword [ebp - 4], eax
jmp 0x3025450
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x302547a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x3025470
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xd
jne 0x3025478
mov edx, dword [ebp - 4]
mov byte [edx], 0
jmp 0x302547a
jmp 0x3025447
lea eax, [ebp - 0x330]
push eax
push 0x105
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0306bbba
add esp, 0xc
cmp dword [ebp - 0x43c], 0
je 0x30254a8
mov edx, dword [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0306b4ac
mov esp, ebp
pop ebp
ret 8
Function at 0x302c870
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x302c887
push 0x57
call fcn.03022180
jmp 0x302c8e4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x302c8aa
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x302c8e2
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x302c8d7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0x10], ecx
jae 0x302c8d7
mov eax, dword [ebp - 4]
jmp 0x302c8e4
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x302c8a1
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x302c980
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x30f2c80
push 0x306b567
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x30f8968]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x302ca30
cmp dword [ebp + 8], 0xffffffff
je 0x302ca30
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x302ca10
mov edx, dword [ebp + 8]
cmp dword [edx + 0x3c], 0
jl 0x302ca10
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3c], 0x10000000
jae 0x302ca10
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x4550
je 0x302ca10
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
jmp 0x302ca30
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3036370
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x14], 0
jne 0x3036396
cmp dword [ebp + 0x18], 0
je 0x303638a
cmp dword [ebp + 0x1c], 0
jne 0x3036396
push 0x57
call fcn.03022180
jmp 0x30364e5
mov eax, dword [ebp + 8]
push eax
call fcn.03047d30
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x30363b4
push 6
call fcn.03022180
jmp 0x30364e5
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.03048630
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x30363dc
push 0x7e
call fcn.03022180
jmp 0x30364e5
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x303649b
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 0x14]
push ecx
call dword [0x30fa624]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x303641e
push 0x57
call fcn.03022180
jmp 0x30364e5
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0x1c], 0
jne 0x3036449
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x57
call fcn.03022180
jmp 0x30364e5
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.0302ccd0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x303648f
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x303648f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x1c]
je 0x303648f
mov ecx, dword [ebp - 4]
push ecx
call fcn.0302cd20
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x30364c1
mov eax, dword [ebp + 0x1c]
push eax
call fcn.0302ccd0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x30364c1
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x30364d0
push 0x57
call fcn.03022180
jmp 0x30364e5
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0302ff80
mov esp, ebp
pop ebp
ret 0x18
Function at 0x3042860
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0x32
push eax
call fcn.03022540
test eax, eax
je 0x304289d
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
push 0x105
mov edx, dword [ebp + 8]
add edx, 0x890
push edx
call fcn.0306beba
add esp, 0xc
mov eax, 1
jmp 0x3042997
mov eax, dword [ebp + 8]
add eax, 0x32
push eax
call fcn.03040bf0
test eax, eax
je 0x30428f0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], 0x200
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x448]
mov dword [edx + 0x868], ecx
mov edx, dword [ebp + 8]
add edx, 0x32
push edx
push 0x105
mov eax, dword [ebp + 8]
add eax, 0x65c
push eax
call fcn.0306beba
add esp, 0xc
mov eax, 1
jmp 0x3042997
mov ecx, dword [0x30f6358]
and ecx, 0x20000
jne 0x3042992
call fcn.030221d0
test eax, eax
je 0x3042929
mov edx, dword [ebp + 8]
add edx, 0xd58
push edx
push 0x30045d0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.030476e0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x30444b0
mov eax, dword [ebp + 8]
add eax, 0x32
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
add eax, 0xd58
push eax
call sym.dbghelp.dll_FindExecutableImageExW
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x448], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x448], 0
jne 0x3042967
xor eax, eax
jmp 0x3042997
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
jne 0x3042987
mov ecx, dword [ebp + 8]
add ecx, 0x20
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.03043000
mov eax, 1
pop ebp
ret 4
Function at 0x3044c10
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x3044c61
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x3044c61
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3047290
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x3038
call fcn.0306b520
mov eax, dword [0x30f8968]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1014], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x30472ca
mov eax, 1
jmp 0x3047433
push 0x1002
lea eax, [ebp - 0x3020]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 8]
push edx
call fcn.030471d0
cmp dword [0x30f7318], 0
je 0x3047385
movzx eax, word [ebp - 0x3020]
test eax, eax
je 0x3047385
push 0x1002
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x3020]
push edx
call fcn.0303cab0
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x3028], eax
mov ecx, dword [ebp - 0x3028]
add ecx, 1
mov dword [ebp - 0x302c], ecx
mov edx, dword [ebp - 0x3028]
mov al, byte [edx]
mov byte [ebp - 0x302d], al
add dword [ebp - 0x3028], 1
cmp byte [ebp - 0x302d], 0
jne 0x3047331
mov ecx, dword [ebp - 0x3028]
sub ecx, dword [ebp - 0x302c]
mov dword [ebp - 0x3034], ecx
push 0
lea edx, [ebp - 0x3024]
push edx
mov eax, dword [ebp - 0x3034]
push eax
lea ecx, [ebp - 0x1010]
push ecx
mov edx, dword [0x30f7318]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x30f731c], 0
je 0x30473b0
movzx eax, word [ebp - 0x3020]
test eax, eax
je 0x30473b0
mov dword [ebp - 0x1014], 1
lea ecx, [ebp - 0x3020]
push ecx
call dword [0x30fa66c]
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
ja 0x30473cb
mov eax, dword [0x30f6358]
and eax, 0x80000000
jne 0x30473cb
mov eax, 1
jmp 0x3047433
mov ecx, dword [ebp + 8]
push ecx
call fcn.03047070
test eax, eax
jne 0x30473f5
cmp dword [ebp - 0x1014], 0
jne 0x30473ee
lea edx, [ebp - 0x3020]
push edx
call dword [0x30fa66c]
mov eax, 1
jmp 0x3047433
cmp dword [ebp + 0xc], 0x20000000
jne 0x3047418
mov eax, dword [ebp + 0x10]
push eax
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call fcn.03046df0
mov dword [ebp - 0x3038], eax
jmp 0x304742d
mov edx, dword [ebp + 0x10]
push edx
push 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.03046df0
mov dword [ebp - 0x3038], eax
mov eax, dword [ebp - 0x3038]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0306b4ac
mov esp, ebp
pop ebp
ret 0xc
Function at 0x304c5d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x30f3570
push 0x306b567
mov eax, dword fs:[0]
push eax
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [0x30f8968]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.03044c10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x304c645
push 6
call fcn.03022180
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x3c]
jmp 0x304c78a
mov ecx, dword [ebp - 0x20]
mov dx, word [ecx]
mov word [ebp - 0x24], dx
movzx eax, word [ebp - 0x24]
cmp eax, 0x5a4d
jne 0x304c700
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx], 0x4550
je 0x304c691
push 0xb
call fcn.03022180
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x304c777
mov edx, dword [ebp - 0x2c]
movzx eax, word [edx + 0x18]
push eax
call fcn.03044b70
test eax, eax
je 0x304c6d7
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x50]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
mov dword [eax], edx
cmp dword [ebp + 0x14], 0
je 0x304c6d5
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x58]
mov dword [eax], edx
jmp 0x304c6fe
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x50]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 8]
mov dword [eax], edx
cmp dword [ebp + 0x14], 0
je 0x304c6fe
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x58]
mov dword [eax], edx
jmp 0x304c744
movzx eax, word [ebp - 0x24]
cmp eax, 0x4944
jne 0x304c73a
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x14]
mov dword [edx], ecx
cmp dword [ebp + 0x14], 0
je 0x304c738
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
jmp 0x304c744
push 0xb
call fcn.03022180
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x304c777
cmp dword [ebp - 0x20], 0
je 0x304c787
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x304f570
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0
call fcn.0304f520
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
push 1
call fcn.0304f520
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x3055e70
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x30f8968]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x310ffb0]
and eax, dword [ebp + 8]
jne 0x3055e94
jmp 0x3055f3d
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
and edx, 0x80000000
jne 0x3055eca
push 0x3006158
push 0x100
lea eax, [ebp - 0x108]
push eax
call fcn.0306bbba
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 5
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x108]
sub ecx, edx
mov eax, 0x100
sub eax, ecx
sub eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0306bab6
add esp, 0x10
mov byte [ebp - 9], 0
mov edx, dword [0x30f889c]
mov dword [ebp - 0x10c], edx
cmp dword [ebp - 0x10c], 0
je 0x3055f18
cmp dword [ebp - 0x10c], 1
je 0x3055f27
jmp 0x3055f3d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x3055f3d
lea ecx, [ebp - 0x108]
push ecx
push 0x3006154
push 0
call fcn.03047560
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0306b4ac
mov esp, ebp
pop ebp
ret