joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b32
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x425018]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov al, byte [ebp + 0x10]
mov dword [esi + 0x10], edi
mov byte [esi + 0x14], al
mov byte [esi + 0x15], 1
mov dword [esi + 0x18], edi
test al, al
je 0x403bbf
call fcn.0040132b
push eax
lea ecx, [esp + 0xc]
call fcn.00403531
lea edx, [esp + 8]
mov dword [esp + 0x18], 0x42307c
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
call fcn.00405d1c
push dword [esp + 8]
lea eax, [esp + 0x10]
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [esp + 8]
mov dword [esi + 0x18], eax
call fcn.00403bfc
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0xc], eax
test eax, eax
je 0x403be7
lea eax, [esp + 0x20]
push eax
push edi
push esi
push 0x403c70
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00408525
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403d38
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.00403dde
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x403dcb
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx + 8], eax
test eax, eax
je 0x403dc4
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [ebx + 0xc], edx
test edx, edx
je 0x403dc4
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x403dc4
mov ecx, dword [ebp - 0x14]
mov al, 1
mov dword [ebx + 0x10], ecx
jmp 0x403dcd
mov ecx, ebx
call fcn.00403dde
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret 4

Function at 0x4040ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
push edi
cmp esi, 0x40
jb 0x404132
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x404132
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x404132
cmp dword [edx + ecx], 0x4550
jne 0x404132
movzx eax, word [edx + ecx + 4]
mov edi, 0x14c
cmp ax, di
je 0x404117
mov edi, 0x8664
cmp ax, di
je 0x404132
add ecx, 0x98
add ecx, edx
mov eax, dword [ecx]
test eax, eax
je 0x404132
add eax, 0xc
cmp esi, eax
sbb eax, eax
not eax
and eax, ecx
jmp 0x404134
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x40f569
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.0040e2e6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040e29b
add esp, 0xc
mov dword [ebp - 0x3c8], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x334]
push eax
call dword [ebp - 0x3c8]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
je 0x410469
push 0
push dword [ebp - 0x66c]
call dword [ebp - 0x33c]
mov dword [ebp - 0x378], eax
push dword [ebp - 0x378]
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 4], eax
invalid
out dx, eax
in al, dx

Function at 0x40ffd1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.0040e2e6
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0040e247
add esp, 0xc
jmp 0x41024e
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.0040e2d6
nop
invalid

Function at 0x418680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4186ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4186ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403480
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x200c
call fcn.0040c4a0
mov eax, dword [0x2b9cbbc]
mov ecx, dword [0x2b9cb30]
shr eax, 3
test eax, eax
jbe 0x4035b2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x4034d0
cmp dword [0x2b9cbbc], 0x959
jne 0x403594
push 0
lea eax, [esp + 0x420]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0xc24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1820]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0x402d3c
push 0x402d4c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004032d0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4034d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
Function at 0x40911b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444a00]
jne 0x409125
repz ret
jmp fcn.0040b3ec

Function at 0x40ab3e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405e7d
and dword [ebp - 4], 0
cmp dword [0x445d88], 0
mov ebx, eax
jne 0x40abef
push 0x402c1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40aca0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c10
push edi
call esi
test eax, eax
je 0x40aca0
push eax
call fcn.00405e0b
mov dword [esp], 0x402c00
push edi
mov dword [0x445d88], eax
call esi
push eax
call fcn.00405e0b
mov dword [esp], 0x402bec
push edi
mov dword [0x445d8c], eax
call esi
push eax
call fcn.00405e0b
mov dword [esp], 0x402bd0
push edi
mov dword [0x445d90], eax
call esi
push eax
call fcn.00405e0b
pop ecx
mov dword [0x445d98], eax
test eax, eax
je 0x40abef
push 0x402bb8
push edi
call esi
push eax
call fcn.00405e0b
pop ecx
mov dword [0x445d94], eax
mov eax, dword [0x445d94]
cmp eax, ebx
je 0x40ac47
cmp dword [0x445d98], ebx
je 0x40ac47
push eax
call fcn.00405e86
push dword [0x445d98]
mov esi, eax
call fcn.00405e86
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ac47
test edi, edi
je 0x40ac47
call esi
test eax, eax
je 0x40ac3e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ac3e
test byte [ebp - 0xc], 1
jne 0x40ac47
or dword [ebp + 0x10], 0x200000
jmp 0x40ac80
mov eax, dword [0x445d8c]
cmp eax, ebx
je 0x40ac80
push eax
call fcn.00405e86
pop ecx
test eax, eax
je 0x40ac80
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ac80
mov eax, dword [0x445d90]
cmp eax, ebx
je 0x40ac80
push eax
call fcn.00405e86
pop ecx
test eax, eax
je 0x40ac80
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445d88]
call fcn.00405e86
pop ecx
test eax, eax
je 0x40aca0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40aca2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xd0c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd0c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd0c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0c06a
add dl, dl
jne 0xd0c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0c0dc
xor eax, eax
add dl, dl
jne 0xd0c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd0c17d
add dl, dl
jne 0xd0c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd0c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd0c075
mov eax, 1
add dl, dl
jne 0xd0c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd0c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0c0e1
sub eax, ebx
mov ebx, 1
jne 0xd0c128
mov ecx, 1
add dl, dl
jne 0xd0c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd0c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd0c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd0c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd0c136
cmp eax, 0x7d00
jae 0xd0c16d
cmp eax, 0x500
jb 0xd0c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0c075
cmp eax, 0x7f
ja 0xd0c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd0c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd0c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd0c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x460957
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004537f8
and dword [ebp - 4], 0
cmp dword [0x491318], 0
mov ebx, eax
jne 0x460a08
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x460ab9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47aac4
push edi
call esi
test eax, eax
je 0x460ab9
push eax
call fcn.00453786
mov dword [esp], 0x47aab4
push edi
mov dword [0x491318], eax
call esi
push eax
call fcn.00453786
mov dword [esp], 0x47aaa0
push edi
mov dword [0x49131c], eax
call esi
push eax
call fcn.00453786
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x491320], eax
call esi
push eax
call fcn.00453786
pop ecx
mov dword [0x491328], eax
test eax, eax
je 0x460a08
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00453786
pop ecx
mov dword [0x491324], eax
mov eax, dword [0x491324]
cmp eax, ebx
je 0x460a60
cmp dword [0x491328], ebx
je 0x460a60
push eax
call fcn.00453801
push dword [0x491328]
mov esi, eax
call fcn.00453801
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x460a60
test edi, edi
je 0x460a60
call esi
test eax, eax
je 0x460a57
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x460a57
test byte [ebp - 0xc], 1
jne 0x460a60
or dword [ebp + 0x10], 0x200000
jmp 0x460a99
mov eax, dword [0x49131c]
cmp eax, ebx
je 0x460a99
push eax
call fcn.00453801
pop ecx
test eax, eax
je 0x460a99
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x460a99
mov eax, dword [0x491320]
cmp eax, ebx
je 0x460a99
push eax
call fcn.00453801
pop ecx
test eax, eax
je 0x460a99
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x491318]
call fcn.00453801
pop ecx
test eax, eax
je 0x460ab9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x460abb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x65bb72b5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x664c5018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x664c5018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x65bb73a2
jmp 0x65bb746f
jmp 0x65bb753c
jmp 0x65bb7609
jmp 0x65bb76d6
jmp 0x65bb77a3
jmp 0x65bb7870
jmp 0x65bb793d
jmp 0x65bb7a0a
jmp 0x65bb7ad7
jmp 0x65bb7ba4
jmp 0x65bb7c71
jmp 0x65bb7d3e
jmp 0x65bb7e0b
jmp 0x65bb7ed8
jmp 0x65bb7fa5
mov dword [ebp - 0x14], 0
jmp 0x65bb8079
jmp 0x65bb8146
jmp 0x65bb8213
jmp 0x65bb82e0
jmp 0x65bb83ad
jmp 0x65bb847a
jmp 0x65bb8547
jmp 0x65bb8614
jmp 0x65bb86e1
jmp 0x65bb87ae
jmp 0x65bb887b
jmp 0x65bb8948
jmp 0x65bb8a15
jmp 0x65bb8ae2
jmp 0x65bb8baf
jmp 0x65bb8c7c
mov dword [ebp - 0x18], 0
jmp 0x65bb8d50
jmp 0x65bb8e1d
jmp 0x65bb8eea
jmp 0x65bb8fb7
jmp 0x65bb9084
jmp 0x65bb9151
jmp 0x65bb921e
jmp 0x65bb92eb
jmp 0x65bb93b8
jmp 0x65bb9485
jmp 0x65bb9552
jmp 0x65bb961f
jmp 0x65bb96ec
jmp 0x65bb97b9
jmp 0x65bb9886
jmp 0x65bb9953
mov dword [ebp - 0x10], 0
jmp 0x65bb9a27
jmp 0x65bb9af4
jmp 0x65bb9bc1
jmp 0x65bb9c8e
jmp 0x65bb9d5b
jmp 0x65bb9e28
jmp 0x65bb9ef5
jmp 0x65bb9fc2
jmp 0x65bba08f
jmp 0x65bba15c
jmp 0x65bba229
jmp 0x65bba2f6
jmp 0x65bba3c3
jmp 0x65bba490
jmp 0x65bba55d
jmp 0x65bba62a
mov dword [ebp - 0x10], 0
jmp 0x65bbe68e
jmp 0x65bba703
jmp 0x65bba7d0
jmp 0x65bba89d
jmp 0x65bba96a
jmp 0x65bbaa37
jmp 0x65bbab04
jmp 0x65bbabd1
jmp 0x65bbac9e
jmp 0x65bbad6b
jmp 0x65bbae38
jmp 0x65bbaf05
jmp 0x65bbafd2
jmp 0x65bbb09f
jmp 0x65bbb16c
jmp 0x65bbb239
jmp 0x65bbb306
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x664c5014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x65bbb3e4
jmp 0x65bbb4b1
jmp 0x65bbb57e
jmp 0x65bbb64b
jmp 0x65bbb718
jmp 0x65bbb7e5
jmp 0x65bbb8b2
jmp 0x65bbb97f
jmp 0x65bbba4c
jmp 0x65bbbb19
jmp 0x65bbbbe6
jmp 0x65bbbcb3
jmp 0x65bbbd80
jmp 0x65bbbe4d
jmp 0x65bbbf1a
jmp 0x65bbbfe7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x664c501c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x65bbc0c5
jmp 0x65bbc192
jmp 0x65bbc25f
jmp 0x65bbc32c
jmp 0x65bbc3f9
jmp 0x65bbc4c6
jmp 0x65bbc593
jmp 0x65bbc660
jmp 0x65bbc72d
jmp 0x65bbc7fa
jmp 0x65bbc8c7
jmp 0x65bbc994
jmp 0x65bbca61
jmp 0x65bbcb2e
jmp 0x65bbcbfb
jmp 0x65bbccc8
mov eax, dword [0x664c5008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x65bbcdb3
jmp 0x65bbce80
jmp 0x65bbcf4d
jmp 0x65bbd01a
jmp 0x65bbd0e7
jmp 0x65bbd1b4
jmp 0x65bbd281
jmp 0x65bbd34e
jmp 0x65bbd41b
jmp 0x65bbd4e8
jmp 0x65bbd5b5
jmp 0x65bbd682
jmp 0x65bbd74f
jmp 0x65bbd81c
jmp fcn.65bbd8e9
mov eax, dword [0x664c5018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x65bba636
nop
leave
ret
Function at 0x3000f049
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0xffffffff
push edi
je 0x30016701
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
call fcn.3000f094
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x30016735
pop edi
pop esi
leave
ret 4
push 0x30016768
lea eax, [ebp - 0x21c]
push 0x15
push eax
call fcn.30022471
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x110]
lea edi, [ebp - 0x110]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.30028332
push 0x30016750
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.30023192
jmp 0x30016714
Function at 0x3000f50a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.30195000
jmp 0x3000f50a
push 0x60
push 0x3000f668
call fcn.30012fb4
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x3001d288
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
je 0x3001d295
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
jne 0x3001d2a3
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x3004f6d4], esi
mov dword [0x3004f6dc], eax
mov dword [0x3004f6e0], ecx
mov dword [0x3004f6e4], edx
mov dword [0x3004f6d8], edi
call fcn.300012b8
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.300039f6
pop ecx
test eax, eax
je 0x3001d2ae
call fcn.30003498
test eax, eax
je 0x3001d2bb
call fcn.30001357
mov dword [ebp - 4], ebx
call fcn.30003087
test eax, eax
jl 0x3001d2c8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x3004fc60], eax
call fcn.30003c5a
mov dword [0x3004f6c8], eax
call fcn.30002e1f
test eax, eax
jl 0x3001d2d5
call fcn.30003194
test eax, eax
jl 0x3001d2e2
push ebx
call fcn.30008eb5
pop ecx
test eax, eax
jne 0x3001d2ef
call fcn.300049e2
test byte [ebp - 0x44], bl
je 0x3000f663
movzx ecx, word [ebp - 0x40]
push ecx
push eax
push 0
push 0x30000000
call main
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x3001d2fb
push eax
call fcn.3000d18e
push 0xa
pop ecx
jmp 0x3000f642
push 0x12
call fcn.30027bb8
pop ecx
jmp 0x3001d34a
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x3001d34a
or edi, 0x8000
jmp 0x3000f590
push 0x1c
call fcn.30027bb8
pop ecx
jmp 0x3000f5d4
push 0x10
call fcn.30027bb8
pop ecx
jmp 0x3000f5e1
push 0x1b
call fcn.3002862c
pop ecx
jmp 0x3000f5f6
push 8
call fcn.3002862c
pop ecx
jmp 0x3000f618
push 9
call fcn.3002862c
pop ecx
jmp 0x3000f625
push eax
call fcn.3002862c
pop ecx
jmp 0x3000f634
call fcn.30028661
jmp 0x3001d330
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x3001d34f
mov eax, 0xff
call fcn.30013054
ret

Function at 0x3000fbbb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
mov edi, ecx
call fcn.3001164b
mov esi, dword [ebp + 0xc]
cmp esi, eax
ja 0x300161e4
mov ecx, edi
call fcn.3001164b
mov ecx, dword [ebp + 0x10]
lea edx, [esi + ecx]
cmp edx, eax
ja 0x300161e4
mov eax, dword [edi + 8]
push ecx
mov ecx, dword [ebp + 8]
lea eax, [eax + esi*2]
push eax
call fcn.30012d0c
pop edi
pop esi
leave
ret 0xc
xor eax, eax
push 0x43
pop ecx
Function at 0x3000fe10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x30016a95
shr al, 4
and al, 1
pop ebp
ret 4
xor al, al
jmp 0x3000fe30

Function at 0x3000fe34
Capabilities:
Enumerate files on windows

Disassembly:
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x2e0]
push eax
call fcn.30010c6b
jmp 0x3001001e
push 0x4ec
mov eax, 0x300427f1
call fcn.3000fdda
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], eax
call fcn.3000fe10
test al, al
je 0x30016af3
mov ecx, esi
call fcn.3000fd70
lea ecx, [ebp - 0x2b8]
call fcn.300123e5
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x2b8]
call fcn.300115a9
mov esi, 0x300113cc
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push 1
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.30011379
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 0
call fcn.30013250
test bl, bl
je 0x3000feed
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 2
call fcn.300115e9
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0
call fcn.30013250
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2b8]
call fcn.300115e9
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.30012f0c
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x264], eax
je 0x30016b27
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x30010dd8
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x3001002d
push 0x3001006c
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x3001002d
mov ecx, edi
call fcn.30012f0c
push eax
lea ecx, [ebp - 0x2e0]
call fcn.30012c7b
push esi
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30012c7b
push 1
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 4
call fcn.30011379
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 3
call fcn.30013250
test bl, bl
je 0x3000ffd3
push esi
lea ecx, [ebp - 0x290]
call fcn.30012c7b
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call fcn.300115e9
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30013250
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.30012c7b
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 6
call fcn.300115e9
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.30013250
lea eax, [ebp - 0x2e0]
push eax
call fcn.3000fe10
test al, al
jne 0x3000c27c
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0
call fcn.30013250
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x3000ff26
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]