joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30029830
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
mov ebp, ecx
mov dword [esp + 0x1c], eax
xor esi, esi
push edi
lea ecx, [esp + 0x14]
xor bl, bl
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
call fcn.300263a0
mov eax, dword [eax]
push eax
call fcn.3007c870
mov ecx, dword [esp + 0x14]
push ecx
mov byte [esp + 0x74], al
call fcn.30208320
mov al, byte [esp + 0x74]
add esp, 8
test al, al
je 0x300299d0
push edi
mov ecx, ebp
call fcn.30027080
mov esi, eax
test esi, esi
je 0x300299d0
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
push edx
push eax
push edi
mov ecx, ebp
call fcn.30029660
test al, al
je 0x300299d0
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
lea edi, [esp + 0x28]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], 0x44
je 0x300298ef
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x74]
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push esi
call edx
test eax, eax
setne bl
jmp 0x30029945
mov edx, dword [esp + 0x70]
push edx
lea ecx, [esp + 0x70]
call fcn.300263a0
mov edi, dword [eax]
push esi
lea ecx, [esp + 0x74]
call fcn.300263a0
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [esp + 0x70]
push eax
setne bl
call fcn.30208320
mov ecx, dword [esp + 0x70]
push ecx
call fcn.30208320
add esp, 8
test bl, bl
je 0x3002996c
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x18]
push ecx
call edi
jmp 0x300299d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x300299d0
mov eax, dword [ebp + 0x84]
test eax, eax
je 0x300299d0
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], 0x3c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x30295c6c
mov dword [esp + 0x38], esi
mov dword [esp + 0x44], 1
call dword [ebp + 0x84]
test eax, eax
setne bl
test bl, bl
jne 0x300299d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.30208320
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x58
ret 0x10
Function at 0x3002a590
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x18], 2
jne 0x3002a613
mov eax, dword [esp + 0xc]
cmp eax, 5
ja 0x3002a5c2
jne 0x3002a613
cmp dword [esp + 0x10], 1
jb 0x3002a613
push esi
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x4a
call esi
test eax, eax
je 0x3002a609
cmp dword [esp + 8], 1
jne 0x3002a609
push 0
lea edx, [esp + 8]
push edx
push 0
push 0x200a
call esi
test eax, eax
je 0x3002a609
cmp dword [esp + 4], 2
jne 0x3002a609
mov eax, 1
pop esi
add esp, 0x9c
ret
xor eax, eax
pop esi
add esp, 0x9c
ret
xor al, al
add esp, 0x9c
ret
Function at 0x3002c890
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf4
push ebx
push esi
push edi
mov ebx, ecx
push 0xe4
mov dword [0x30335004], ebx
call fcn.3007a1f0
add esp, 4
test eax, eax
je 0x3002ca12
push 0
mov ecx, eax
call fcn.30029200
mov esi, eax
test esi, esi
je 0x3002ca12
push esi
call fcn.3002f110
add esp, 4
lea ecx, [esp + 0x40]
call fcn.30073450
lea eax, [esp + 0x40]
push eax
mov ecx, esi
call fcn.300286d0
test al, al
je 0x3002c965
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x34]
call fcn.30073250
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x14]
call fcn.30073250
push str.Macromed
lea ecx, [esp + 0x14]
call fcn.30073a50
push 0x30295e28
lea ecx, [esp + 0x14]
call fcn.30073a50
lea eax, [esp + 0x10]
push eax
push esi
mov ecx, ebx
call fcn.30056b20
test al, al
jne 0x3002c947
lea ecx, [esp + 0x30]
push ecx
push esi
mov ecx, ebx
call fcn.30056b20
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call fcn.30055680
lea ecx, [esp + 0x10]
call fcn.300731a0
lea ecx, [esp + 0x30]
call fcn.300731a0
lea ecx, [esp + 0x50]
call fcn.30073450
lea ecx, [esp + 0x20]
call fcn.30073450
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call dword [eax + 0x54]
lea ecx, [esp + 0x20]
call fcn.300732d0
test al, al
jne 0x3002c99d
lea edx, [esp + 0x20]
push edx
push esi
mov ecx, ebx
call fcn.300578e0
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x64], 0x9c
call edi
test eax, eax
jne 0x3002c9d6
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x64], 0x94
call edi
test eax, eax
je 0x3002c9ef
mov eax, dword [esp + 0x70]
cmp eax, 2
jb 0x3002c9ef
jne 0x3002c9e8
cmp dword [esp + 0x64], 5
jb 0x3002c9ef
mov byte [ebx + 0x92d], 1
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
lea ecx, [esp + 0x20]
call fcn.300731a0
lea ecx, [esp + 0x50]
call fcn.300731a0
lea ecx, [esp + 0x40]
call fcn.300731a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3002cc90
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x3002cf50
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 2
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
test ebx, ebx
jl 0x3002cfbd
cmp ebx, 0xff
jg 0x3002cfbd
cmp ebx, 0x7f
jg 0x3002cfb6
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
mov al, byte [esi + 9]
je 0x3002cfa6
test al, al
je 0x3002cfb6
push ebx
call fcn.3002ce10
add esp, 4
test al, al
jne 0x3002cfaa
push ebx
mov ecx, esi
call fcn.3002ce30
movzx ebx, al
pop esi
mov al, bl
pop ebx
ret 4
test al, al
jne 0x3002cf94
movzx eax, bl
movzx ebx, byte [eax + 0x302993c8]
xor ebx, eax
pop esi
mov al, bl
pop ebx
ret 4
mov al, byte [esp + 0xc]
pop esi
pop ebx
ret 4
Function at 0x3002db60
Capabilities:
Check mutex on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], ebx
je 0x3002db81
mov dword [esi], 0x30295f2c
mov dword [esi + 0x20], 0x30295e70
push ebx
mov ecx, esi
call fcn.3007e410
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [esi + ecx], 0x30295ea0
mov edx, dword [esi]
mov eax, dword [edx + 4]
push str.MacromediaMutexOmega
lea ecx, [eax - 0x20]
mov dword [eax + esi - 4], ecx
push 1
push ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x14], eax
je 0x3002dbd5
call edi
cmp eax, 0xb7
jne 0x3002dbd5
mov cl, 1
jmp 0x3002dbd7
xor cl, cl
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x3002dc65
cmp cl, bl
je 0x3002dbf3
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x3002dc65
push 0x30295f00
push 0xfc10
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x18], eax
call edi
mov edi, eax
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x3002dc5b
push 0xfc10
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x3002dc5b
cmp edi, 0xb7
setne dl
mov ecx, esi
push edx
push eax
call fcn.3007dce0
mov ecx, esi
call fcn.3007dd20
test al, al
jne 0x3002dc5b
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], ebx
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [esi + 8], ebx
jne 0x3002dc8a
mov eax, dword [esi + 0x18]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x3002dc7d
push eax
call edi
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x3002dc8a
push eax
call edi
mov dword [esi + 0x14], ebx
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x3002f330
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi], 0
push eax
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x3002f3d6
cmp word [ecx + 8], 2
push ebp
push edi
jne 0x3002f3a9
cmp word [ecx + 0xa], 4
jne 0x3002f3a9
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x3002f3a9
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
push ebp
call fcn.3002f2c0
test eax, eax
mov dword [esi], eax
je 0x3002f3ca
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x3002f380
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx]
push 0x400
push eax
push ebx
call fcn.3028d430
add esp, 0xc
pop edi
pop ebp
pop esi
mov byte [ebx + 0x400], 0
xor eax, eax
pop ebx
ret 0x18
pop edi
pop ebp
pop esi
mov eax, 8
pop ebx
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x3002f3e6.11001
jmp dword [eax*4 + 0x3002f40c]
pop esi
mov eax, 0x2af9
pop ebx
ret 0x18
pop esi
mov eax, 0x2afa
pop ebx
ret 0x18
pop esi
mov eax, 0x2afb
pop ebx
ret 0x18
Function at 0x3002fba0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x30335850]
test eax, eax
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x3002f670
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x3002f960
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.3002f620
jne 0x3002fcf2
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x3002fce8
xor eax, eax
nop
mov cl, byte [esp + eax + 0x124]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x3002fc00
push edi
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x3002fc16
mov edx, dword [str.ws2_32]
mov eax, dword [0x30296088]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x3002fc5d
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x3002fcaf
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x3002fc60
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x3002fc75
mov edx, dword [str.wship6]
mov eax, dword [0x30296080]
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov esi, eax
test esi, esi
je 0x3002fce4
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x3002fcaf
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x3002fce4
xor edi, edi
mov edx, dword [esp + edi*8 + 0x10]
push edx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x3002fca6
inc edi
cmp edi, 3
jl 0x3002fcb1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [0x30300140], eax
mov dword [0x30300148], ecx
mov dword [fcn.3002f620], edx
pop esi
pop ebp
pop ebx
pop edi
mov dword [0x30335850], 1
movzx eax, word [esp + 0x230]
mov eax, dword [eax*8 + 0x30300140]
add esp, 0x22c
ret 4

Function at 0x3002fd70
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x3033584c]
sub esp, 0x190
cmp eax, 1
je 0x3002fdae
cmp eax, 2
je 0x3002fdca
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x3002fdc0
mov ax, word [esp]
cmp al, 2
jne 0x3002fdba
cmp ah, al
jne 0x3002fdba
mov dword [0x3033584c], 1
mov eax, 1
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x3033584c], 2
xor eax, eax
add esp, 0x190
ret

Function at 0x3002fde0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x3002fe1d
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x3002fe11
jne 0x3002fe1d
cmp dword [esp + 8], 1
jb 0x3002fe1d
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x3002fe30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov ebx, eax
xor ebp, ebp
cmp ebx, ebp
push edi
mov edi, ecx
mov esi, edx
jne 0x3002fe50
pop edi
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
add esp, 0x3c
ret
mov dword [ebx], ebp
call fcn.3002fde0
test al, al
jne 0x3002ff0e
push 0x30
mov dword [esp + 0x14], 0x2afb
call fcn.3007a1f0
add esp, 4
cmp eax, ebp
je 0x3002ff02
mov dword [ebx], eax
lea ebx, [eax + 0x20]
mov dword [eax], ebp
mov dword [eax + 4], 2
mov dword [eax + 8], 1
mov dword [eax + 0xc], 6
mov dword [eax + 0x10], 0x10
mov dword [eax + 0x14], ebp
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebp
xor eax, eax
mov ecx, ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push edi
mov word [ebx], 2
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebx + 2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
lea edi, [ebx + 4]
mov dword [edi], eax
jne 0x3002fefe
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebp
je 0x3002ff02
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov esi, dword [edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [eax + 8]
mov word [ebx], ax
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push 0xa
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.30074b90
mov edx, dword [esp + 0x50]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 6
call fcn.30075610
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x5b
jne 0x3002ff9a
mov ecx, dword [esp + 0x18]
cmp ecx, 1
jl 0x3002ffda
cmp byte [ecx + eax - 1], 0x5d
jne 0x3002ffda
add ecx, 0xfffffffe
push ecx
inc esi
push esi
lea ecx, [esp + 0x1c]
call fcn.30074a60
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x30]
push ecx
push edx
push eax
call fcn.3002fd10
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call fcn.30208320
mov ecx, dword [esp + 0x24]
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call fcn.30208320
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push eax
call fcn.30208320
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call fcn.30208320
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
add esp, 0x3c
ret
Function at 0x30030690
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x84
push esi
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x300306c4
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
push ecx
mov ecx, dword [esp + 0x94]
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
test eax, eax
je 0x300306d3
mov eax, 1
pop esi
add esp, 0x84
ret 0x10
mov ecx, dword [esi + 8]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x10], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x30030705
mov edx, dword [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x10]
call fcn.300303c0
xor eax, eax
pop esi
add esp, 0x84
ret 0x10

Function at 0x30031010
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push 0xd0
mov edi, ecx
call fcn.3007a1f0
add esp, 4
test eax, eax
je 0x30031095
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push edi
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push ecx
mov ecx, eax
call fcn.30030ee0
mov esi, eax
test esi, esi
je 0x30031095
lea edx, [esp + 8]
push edx
push 0
push esi
push 0x30030770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [edi + 4], eax
je 0x30031072
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ecx
ret 0xc
mov eax, dword [esi + 0x24]
push eax
call fcn.30208320
add esp, 4
push esi
mov dword [esi + 0x30], 0x3029602c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call fcn.30208320
add esp, 4
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x300314b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x30
push edi
lea eax, [esp + 0x44]
mov edi, ecx
mov ecx, dword [esp + 0x44]
push eax
push ecx
call fcn.3009f9d0
add esp, 8
test al, al
je 0x3003165a
mov edx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x48]
push esi
push 1
push ebp
push edx
call fcn.3009fa50
mov esi, eax
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
jne 0x30031506
mov eax, dword [esp + 0x48]
push ebp
push eax
mov ecx, edi
call fcn.300313e0
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x30
ret 0x10
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.GDI32.dll_SaveDC]
xor ecx, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x50]
mov ch, al
movzx edx, ah
movzx eax, byte [esp + 0x52]
or ecx, edx
shl ecx, 8
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
mov ebp, eax
push ebp
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 0x48]
mov ecx, dword [eax + 0x24]
push 1
push ecx
call dword [sym.imp.GDI32.dll_SelectClipPath]
mov dword [esp + 0x10], 0x28
mov edx, dword [esi + 0x10]
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov eax, 1
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
mov eax, dword [esi + 8]
mov ecx, 2
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov cl, byte [eax + 6]
mov byte [esp + 0x3a], cl
mov dl, byte [eax + 5]
mov byte [esp + 0x39], dl
mov cl, byte [eax + 4]
mov byte [esp + 0x38], cl
mov byte [esp + 0x3b], bl
mov dl, byte [eax + 0xa]
mov byte [esp + 0x3e], dl
mov cl, byte [eax + 9]
mov byte [esp + 0x3d], cl
mov dl, byte [eax + 8]
mov ecx, esi
mov byte [esp + 0x3c], dl
mov byte [esp + 0x3f], bl
call fcn.300b9020
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
push 0xb8074a
push ebx
lea ebx, [esp + 0x18]
push ebx
mov ebx, dword [esi + 4]
push ebx
mov ebx, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0x10]
push ebx
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 4]
push 0
push 0
sub ebx, ecx
push ebx
sub eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x48]
push edx
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov ecx, esi
call fcn.300b9040
mov ecx, esi
call fcn.300b9180
push esi
call fcn.30208320
mov eax, dword [esp + 0x50]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
add esp, 4
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x44]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
push eax
push edx
call dword [sym.imp.GDI32.dll_RestoreDC]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x30
ret 0x10
Function at 0x30032100
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x30032119
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x3003212a
push eax
call edi
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x3003213b
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [0x3033588c]
test eax, eax
pop edi
pop esi
je 0x30032165
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x3033588c]
push eax
call fcn.30208320
add esp, 4
mov dword [0x3033588c], 0
ret
Function at 0x30033270
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x9c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
push eax
mov byte [esi + 0x24], 0
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x300332ed
cmp dword [esp + 0x1c], 2
jne 0x300332ed
cmp dword [esp + 0x10], 4
mov eax, str.Security.dll
je 0x300332b9
mov eax, str.Secur32.dll
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebp
test eax, eax
mov dword [esi], eax
je 0x300332ec
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitSecurityInterfaceA
push eax
call edi
test eax, eax
jne 0x300332f7
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], 0
pop edi
pop ebp
mov eax, esi
pop esi
add esp, 0x9c
ret
call eax
test eax, eax
mov dword [esi + 4], eax
jne 0x30033305
mov edx, dword [esi]
push edx
jmp 0x300332df
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [eax + 4]
test eax, eax
jne 0x30033321
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 4]
push ecx
call dword [eax + 0x40]
push str.crypt32.dll
call ebp
test eax, eax
mov dword [esi + 8], eax
je 0x30033300
push str.CertGetCertificateChain
push eax
call edi
test eax, eax
mov dword [esi + 0xc], eax
je 0x3003339c
mov eax, dword [esi + 8]
push str.CertVerifyCertificateChainPolicy
push eax
call edi
test eax, eax
mov dword [esi + 0x10], eax
je 0x3003339c
mov ecx, dword [esi + 8]
push str.CertFreeCertificateChain
push ecx
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x3003339c
mov edx, dword [esi + 8]
push 0x30296388
push edx
call edi
test eax, eax
mov dword [esi + 0x18], eax
je 0x3003339c
mov eax, dword [esi + 8]
push str.CertOpenSystemStoreW
push eax
call edi
test eax, eax
mov dword [esi + 0x1c], eax
je 0x3003339c
mov ecx, dword [esi + 8]
push 0x30296360
push ecx
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x300332eb
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edx
call edi
mov eax, dword [esi]
push eax
mov dword [esi + 8], 0
call edi
pop edi
pop ebp
mov dword [esi], 0
mov eax, esi
pop esi
add esp, 0x9c
ret