joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401410
Capabilities:
Identify system language via api
Read .ini file

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x3c]
mov ecx, ebp
call fcn.0040426a
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0
mov ebx, str.Startup
push str.copy
push ebx
call edi
test eax, eax
setne al
mov ecx, ebp
mov byte [esi + 6], al
call fcn.0040426a
push eax
push 1
push str.engine
push ebx
call edi
neg eax
sbb al, al
and byte [esp + 0x10], 0
inc al
lea edi, [esp + 0x11]
mov byte [esi + 5], al
xor eax, eax
mov ecx, ebp
stosw word es:[edi], ax
call fcn.0040426a
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [esp + 0x14]
push 3
push eax
push 0x4063c0
push str.EnableLangDlg
push ebx
call edi
cmp eax, 1
jne 0x4014a2
cmp byte [esp + 0x10], 0x79
je 0x40149e
cmp byte [esp + 0x10], 0x59
jne 0x4014a2
mov byte [esi + 8], 1
mov ecx, ebp
call fcn.0040426a
push eax
lea eax, [esi + 0x48]
push 0x1f4
push eax
push 0x4063c0
push str.AppName
push ebx
call edi
mov ecx, ebp
call fcn.0040426a
push eax
push 0
mov ebx, str.Languages
push str.count
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and dword [esp + 0x14], 0
mov dword [esi + 0x244], eax
test eax, eax
jle 0x40154e
lea eax, [esi + 0x248]
mov dword [esp + 0x18], eax
push dword [esp + 0x14]
lea eax, [esp + 0x2c]
push str.key_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, ebp
call fcn.0040426a
push eax
lea eax, [esp + 0x20]
push 0xa
push eax
lea eax, [esp + 0x34]
push 0x4063c0
push eax
push ebx
call edi
lea eax, [esp + 0x1e]
push eax
call fcn.004046c0
inc dword [esp + 0x18]
pop ecx
mov ecx, dword [esp + 0x18]
add dword [esp + 0x18], 2
mov word [ecx], ax
mov eax, dword [esp + 0x14]
cmp eax, dword [esi + 0x244]
jl 0x4014f4
mov ecx, ebp
call fcn.0040426a
push eax
lea eax, [esp + 0x20]
push 0xa
push eax
push str.0x0409
push str.Default
push ebx
call edi
lea eax, [esp + 0x1e]
push eax
call fcn.004046c0
mov word [esi + 0x240], ax
mov ax, word [esi + 0x23c]
pop ecx
push eax
mov ecx, esi
call fcn.004015f9
test al, al
jne 0x4015dc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea edi, [esi + 0x312]
push eax
mov ecx, esi
mov word [edi], ax
call fcn.004015f9
test al, al
jne 0x4015f1
mov ax, word [edi]
mov ecx, esi
and eax, 0x3ff
or ah, 4
push eax
mov word [edi], ax
call fcn.004015f9
test al, al
jne 0x4015f1
push edi
mov ecx, esi
call fcn.00401627
test al, al
jne 0x4015f1
mov ax, word [esi + 0x240]
mov word [edi], ax
jmp 0x4015f1
mov ax, word [esi + 0x23c]
mov byte [esi + 0x23e], 1
mov word [esi + 0x312], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x402cbe
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x22f], bl
jne 0x402e4b
cmp byte [esi + 0x22b], bl
jne 0x402e4b
cmp byte [esi + 0x22e], bl
je 0x402e4b
cmp byte [esi + 0x228], bl
jne 0x402e4b
lea eax, [ebp - 0x270]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x402e4b
lea eax, [ebp - 0x16c]
push eax
push ebx
lea eax, [ebp - 0x270]
push 0x406290
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x402e4b
lea eax, [ebp - 0x16c]
push ebx
push eax
lea ecx, [esi + 0x240]
call fcn.0040426a
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x402e4b
push edi
push ebx
push 0x4000000
push 3
push ebx
push 1
lea eax, [ebp - 0x16c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x10
mov dword [ebp - 8], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
push str.__clone_of_
rep stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x68], 0x44
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24c]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 4], eax
call edi
push eax
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.00401700
push 0x406270
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push eax
mov dword [ebp - 4], eax
call edi
push eax
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.00401700
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esi + 0x234]
push esi
call edi
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00401700
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
call fcn.0040426a
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x14]
call fcn.0040114d
lea ecx, [ebp - 0x24]
call fcn.00402e51
cmp dword [ebp - 8], 0xffffffff
pop edi
je 0x402e47
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x402e4d
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x30004ec3
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x3001eef0], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x30004f07
call ebx
test eax, eax
jns 0x30004efd
push 0x30001888
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x3000187c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x3001eeec], eax
mov dword [0x3001eef0], 1
mov eax, dword [0x3001eeec]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x30004f23
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x30004f53
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x30004f49
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x30004f3e
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x30004f43
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x30004f52
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x300089e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x300089fd
test al, 0x10
jne 0x300089fd
xor eax, eax
inc eax
jmp 0x300089ff
xor eax, eax
pop ebp
ret 4
Function at 0x30008aad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push dword [0x3001ef2c]
mov dword [ebp - 0x18], 0x300019d0
push dword [0x3001ef28]
mov dword [ebp - 0x14], edi
push eax
mov dword [ebp - 0x10], edi
call dword [ecx + 0x14]
cmp eax, edi
mov dword [ebp - 0xc], eax
jl 0x30008bbf
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x30008bbf
lea ecx, [ebp - 0x64]
call fcn.30013d5e
lea eax, [ebp - 0x64]
push edi
push eax
call sub.MSVCR80.dll__setjmp3
cmp eax, edi
pop ecx
pop ecx
mov esi, 0x1000
jne 0x30008b38
push esi
call fcn.30013e7b
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x30008b7b
push 0x3001ea70
call fcn.30013e0c
test eax, eax
je 0x30008b75
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x10]
push 0x8007000e
call fcn.30010730
mov esi, eax
call fcn.30013d7c
push dword [ebp - 0x14]
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
push edi
call fcn.30013da4
call fcn.30013d7c
mov ebx, dword [ebp + 0xc]
jmp 0x30008baa
cmp dword [ebp - 4], edi
je 0x30008bbf
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x30008bbf
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jne 0x30008bbf
mov eax, dword [ebx]
lea ecx, [ebp - 4]
push ecx
push esi
push dword [ebp - 0x14]
push ebx
call dword [eax + 0xc]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x30008b85
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc]
jmp 0x30008b63
Function at 0x30008c82
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x24], 0x30002254
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x300019d0
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call fcn.30013d5e
lea eax, [ebp - 0x70]
push edi
push eax
call sub.MSVCR80.dll__setjmp3
cmp eax, edi
pop ecx
pop ecx
mov ebx, 0x1000
jne 0x30008ccd
push ebx
call fcn.30013e7b
pop ecx
mov dword [ebp - 0x18], eax
jmp 0x30008d12
push 0x3001ea70
call fcn.30013e0c
test eax, eax
je 0x30008d0c
mov ecx, dword [ebp + 0x10]
push 0x8007000e
call fcn.30010730
mov esi, eax
call fcn.30013d7c
push dword [ebp - 0x18]
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x20]
cmp eax, edi
pop ecx
je 0x30008d05
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x30008e1c
push edi
call fcn.30013da4
call fcn.30013d7c
push 0x7f02
lea ecx, [ebp - 0xc]
call fcn.30006ac6
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push 0xb
push 0x12
push 0x30001608
push 0x37010102
push esi
call dword [eax + 0x1c]
cmp eax, edi
mov dword [ebp - 0x10], eax
jge 0x30008d5d
mov ecx, dword [ebp + 0x10]
push esi
push eax
call fcn.3001075e
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x30008cef
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x30008de0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push edi
push edi
push dword [0x3001ef2c]
push dword [0x3001ef28]
push eax
call dword [ecx + 0x14]
cmp eax, edi
mov dword [ebp - 0x10], eax
jge 0x30008da3
mov ecx, dword [ebp + 0x10]
push eax
call fcn.30010730
jmp 0x30008d50
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x30008dca
cmp dword [ebp - 4], edi
je 0x30008ddc
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push dword [ebp - 4]
push dword [ebp - 0x18]
push eax
call dword [ecx + 0x10]
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x30008d98
push edi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 0x18]
push dword [ebp - 8]
call esi
cmp eax, edi
jne 0x30008dab
cmp eax, edi
jne 0x30008de8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x30008deb
mov dword [ebp - 0x10], edi
cmp dword [ebp - 8], 0xffffffff
je 0x30008dfa
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp - 0x18]
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x20]
cmp eax, edi
pop ecx
je 0x30008e19
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x30008f16
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
mov byte [eax], 0
je 0x30008f7b
cmp byte [esi], 0
je 0x30008f7b
cmp byte [esi + 1], 0x3a
jne 0x30008f7b
cmp byte [esi + 2], 0x5c
jne 0x30008f7b
push eax
push 0x226
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov cl, byte [esi]
mov eax, esi
jmp 0x30008f5d
cmp cl, 0x5c
jne 0x30008f54
mov edi, eax
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
test cl, cl
jne 0x30008f4d
mov eax, edi
sub eax, esi
cmp eax, 2
jne 0x30008f6b
inc edi
push ebx
mov bl, byte [edi]
push esi
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov byte [edi], bl
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x3000edac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x300033f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x10
pop ecx
mov esi, 0x30002a10
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x3001b96c]
mov edx, dword [ebp + 8]
and dword [ebp - 0xa4], 0
cmp eax, 0xffffffff
movsb byte es:[edi], byte [esi]
push 0xe
pop ecx
mov esi, 0x300029d4
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x30001568
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x90], edx
movsb byte es:[edi], byte [esi]
jne 0x3000ef47
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
push 4
pop esi
lea eax, [ebp - 0x94]
push eax
push 1
push 0
lea eax, [ebp - 0x8c]
push eax
mov ebx, 0x80000001
push ebx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x9c], esi
call edi
test eax, eax
jne 0x3000ee99
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x3000ee81
cmp dword [ebp - 0x98], esi
jne 0x3000ee81
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
jmp 0x3000ee8b
mov dword [ebp - 0xa4], 1
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x3000eea3
mov dword [ebp - 0xa4], 1
cmp dword [ebp - 0xa4], 0
je 0x3000ef37
lea eax, [ebp - 0x94]
push eax
push 1
push 0
lea eax, [ebp - 0x48]
push eax
push ebx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x9c], esi
call edi
test eax, eax
jne 0x3000ef29
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x3000ef0d
cmp dword [ebp - 0x98], esi
jne 0x3000ef0d
mov eax, dword [ebp - 0xa0]
jmp 0x3000ef13
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov ecx, dword [ebp - 0x90]
push dword [ebp - 0x94]
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x3000ef37
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [0x3001b96c], eax
pop ebx
jmp 0x3000ef49
mov dword [edx], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.30017978
leave
ret 4
Function at 0x30011c48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, dword [ecx + 0x20]
xor ebx, ebx
cmp edi, ebx
jne 0x30011c5d
cmp dword [ecx + 0x28], ebx
jne 0x30011c5d
xor eax, eax
inc eax
jmp 0x30011cb3
cmp edi, ebx
push esi
mov esi, dword [ecx + 0x28]
je 0x30011c8a
mov esi, dword [0x3001eb1c]
push 5
push edi
push esi
call fcn.300161ec
cmp eax, ebx
je 0x30011c86
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x30011c8a
xor eax, eax
jmp 0x30011cb2
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test byte [eax], 1
jne 0x30011c9c
cmp word [eax + 0xa], bx
je 0x30011ca2
cmp word [eax + 0xc], bx
jne 0x30011ca5
xor ebx, ebx
inc ebx
test edi, edi
je 0x30011cb0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop esi
pop edi
pop ebx
ret

Function at 0x30012885
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
je 0x30012935
mov esi, dword [0x3001eb1c]
push 0xf0
push dword [ebp + 8]
push esi
call fcn.300161ec
cmp eax, ebx
je 0x30012935
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x30012935
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
movzx eax, word [esi]
cmp ax, bx
je 0x30012926
inc esi
inc esi
movzx ecx, ax
movzx eax, word [esi]
inc esi
inc esi
mov edi, dword [esi]
add esi, 4
cmp ax, 0x401
jne 0x300128f6
mov eax, 0x180
jmp 0x30012901
cmp ax, 0x403
jne 0x30012901
mov eax, 0x143
push esi
movzx eax, ax
push ebx
push eax
movzx eax, cx
push eax
mov eax, dword [ebp - 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, 0xffffffff
jne 0x3001291f
mov dword [ebp - 4], ebx
add esi, edi
cmp dword [ebp - 4], ebx
jne 0x300128d2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 4], ebx
pop edi
je 0x30012949
mov eax, dword [ebp - 8]
push ebx
push ebx
push ebx
push ebx
push 0x364
push dword [eax + 4]
call fcn.30011f99
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x30013550
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
jg 0x3001360d
mov edi, dword [ecx + 4]
cmp edi, esi
mov ebx, 0x363
je 0x3001359a
mov eax, dword [edi + 4]
cmp eax, esi
je 0x3001359a
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x3001359a
push esi
inc esi
push esi
push ebx
push dword [edi + 4]
push edi
call fcn.30011d7e
push esi
push esi
push 0
push esi
push ebx
push dword [edi + 4]
call fcn.30011f99
call fcn.30015f53
mov esi, dword [eax + 8]
jmp 0x30013607
mov eax, dword [esi + 4]
test eax, eax
je 0x30013604
cmp esi, edi
je 0x30013604
cmp dword [esi + 0x50], 0
jne 0x300135be
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x300135d0
cmp dword [esi + 0x50], eax
jl 0x300135ef
push 0
push 1
push ebx
push dword [esi + 4]
push esi
call fcn.30011d7e
push 1
push 1
push 0
push 1
push ebx
push dword [esi + 4]
call fcn.30011f99
mov eax, dword [esi + 0x50]
test eax, eax
jle 0x30013600
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [esi + 0x50], 0xffffffff
mov esi, dword [esi + 0x38]
test esi, esi
jne 0x300135a4
jmp 0x30013621
call fcn.30015f53
cmp dword [eax + 0x14], esi
jne 0x30013621
call fcn.30015faf
call fcn.30016008
xor eax, eax
cmp dword [ebp + 8], eax
pop edi
pop esi
setl al
pop ebx
pop ebp
ret 4

Function at 0x300148ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [0x3001eb1c]
push edi
push 5
push dword [ebp + 8]
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x3001492c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x3001492c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 8], eax
je 0x30014923
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov eax, dword [0x3001fbd4]
test eax, eax
push ebx
je 0x30014908
call eax
jmp 0x3001490f
call dword [sym.imp.MSVCR80.dll_malloc]
pop ecx
test eax, eax
mov dword [ebp - 4], eax
je 0x30014923
push ebx
push dword [ebp + 8]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x30014935
mov dword [eax], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x3001493f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.300148ae

Function at 0x3001641f
Capabilities:
Allocate thread local storage

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
call esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x30016444
cmp al, 3
ja 0x30016444
cmp edi, 2
ja 0x30016444
call esi
mov edi, eax
jmp 0x30016439
mov eax, edi
pop edi
pop esi
ret
Function at 0x300178c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x30003414
push 0x300033f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x300178f9
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x300033f4
push ebx
call edi
test esi, esi
mov dword [0x300033f4], esi
jne 0x3001795d
mov dword [0x300033f4], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x3001edf8], 0x44bf19b1
pop ebx
leave
ret

Function at 0x30017978
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x300033f4]
jne 0x30017eb3
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3001fea0], eax
mov dword [0x3001fe9c], ecx
mov dword [0x3001fe98], edx
mov dword [0x3001fe94], ebx
mov dword [0x3001fe90], esi
mov dword [0x3001fe8c], edi
mov word [0x3001feb8], ss
mov word [0x3001feac], cs
mov word [0x3001fe88], ds
mov word [0x3001fe84], es
mov word [0x3001fe80], fs
mov word [0x3001fe7c], gs
pushfd
pop dword [0x3001feb0]
mov eax, dword [ebp]
mov dword [0x3001fea4], eax
mov eax, dword [ebp + 4]
mov dword [0x3001fea8], eax
lea eax, [ebp + 8]
mov dword [0x3001feb4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3001fdf0], 0x10001
mov eax, dword [0x3001fea8]
mov dword [0x3001fda4], eax
mov dword [0x3001fd98], 0xc0000409
mov dword [0x3001fd9c], 1
mov eax, dword [0x300033f4]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3001edf8]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x3001fde8], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x30003430
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x3001fde8], 0
jne 0x30017fa3
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret