joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30053a44
Capabilities:
Set file attributes

Disassembly:
push ebp
mov eax, 0x1084
lea ebp, [esp - 0x1004]
call fcn.300621a2
mov eax, dword [section..cdata]
push ebx
push edi
xor edi, edi
inc edi
push edi
mov dword [ebp + 0x1000], eax
mov ebx, 0x824
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.30053731
add esp, 0xc
test eax, eax
jne 0x30053a85
or eax, 0xffffffff
jmp 0x30053bf6
cmp word [ebp - 0x68], 0
push esi
lea esi, [ebp - 0x68]
mov dword [ebp - 0x74], esi
je 0x30053a9e
inc esi
inc esi
cmp word [esi], 0
jne 0x30053a93
mov dword [ebp - 0x74], esi
push edi
call fcn.3005354d
push 4
pop eax
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push eax
push 0x30014d30
push 0x30014d44
push 0x80000001
mov dword [ebp - 0x7c], eax
call fcn.3005539e
add esp, 0x1c
test eax, eax
jne 0x30053ad1
mov dword [ebp - 0x6c], edi
mov eax, dword [ebp - 0x6c]
cmp eax, 0x64
mov dword [ebp - 0x80], eax
jbe 0x30053ae1
mov eax, edi
mov dword [ebp - 0x6c], eax
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea ecx, [ebp - 0x68]
sub esi, ecx
sar esi, 1
mov dword [ebp - 0x70], ebx
sub dword [ebp - 0x70], esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0x80
push eax
push 0x30014cc8
lea eax, [ebp + 0xfe0]
push 0x1f
push eax
call edi
add esp, 0x10
push dword [ebp - 0x70]
lea eax, [ebp + 0xfe0]
push dword [ebp - 0x74]
push eax
call fcn.3004de95
push 0
push esi
push 1
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x68]
push eax
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
jne 0x30053b9c
mov eax, dword [ebp - 0x6c]
cmp eax, 0x64
jb 0x30053b4b
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], eax
jne 0x30053aff
push eax
push 0x30014cc8
lea eax, [ebp + 0xfe0]
push 0x1f
push eax
call edi
add esp, 0x10
push dword [ebp - 0x70]
lea eax, [ebp + 0xfe0]
push dword [ebp - 0x74]
push eax
call fcn.3004de95
push esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x68]
push eax
call ebx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x6c], 0x64
pop esi
jb 0x30053ba7
and dword [ebp - 0x6c], 0
inc dword [ebp - 0x6c]
push 4
lea eax, [ebp - 0x6c]
push eax
push 4
push 0x30014d30
push 0x30014d44
push 0x80000001
call fcn.30055454
add esp, 0x18
push dword [0x30065bcc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp + 0x100c], 0
je 0x30053bf3
push dword [ebp + 0x1010]
lea eax, [ebp - 0x68]
push dword [ebp + 0x100c]
push eax
call fcn.3004f088
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + 0x1000]
pop edi
pop ebx
call fcn.30062195
add ebp, 0x1004
leave
ret

Function at 0x30053c0b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x30053c52
push esi
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x30053c51
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret
Function at 0x30053c54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0xffffffff
jne 0x30053c64
xor eax, eax
leave
ret
push ebx
lea eax, [ebp - 0xc]
push esi
push eax
xor ebx, ebx
call fcn.300537ed
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], ebx
call fcn.300521be
test eax, eax
jne 0x30053c9c
push 0x11a
push esi
mov dword [ebp - 8], 1
call fcn.300534e7
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
je 0x30053d00
push edi
mov edi, 0x300bb9b8
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push esi
push dword [ebp - 4]
call fcn.30053880
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x30053cf8
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x30053ce7
cmp dword [ebp - 0xc], esi
jne 0x30053ce7
xor ebx, ebx
inc ebx
jmp 0x30053ce9
xor ebx, ebx
push esi
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.30053c0b
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x30053d25
cmp dword [ebp - 8], 0
push dword [ebp - 4]
je 0x30053d20
call fcn.30053426
pop ecx
jmp 0x30053d25
call fcn.300522bc
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x30054919
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2094
call fcn.300621a2
mov eax, dword [section..cdata]
push ebx
push esi
xor ebx, ebx
inc ebx
push ebx
mov dword [ebp - 4], eax
mov esi, 0x824
lea eax, [ebp - 0x2094]
push esi
push eax
call fcn.30053731
add esp, 0xc
test eax, eax
je 0x30054a23
push edi
push 0x30014cd8
call fcn.3004ded0
mov edi, eax
test edi, edi
je 0x30054a22
push esi
lea eax, [ebp - 0x2094]
push eax
push edi
call fcn.3004f0ca
push edi
call fcn.300522bc
call fcn.30054906
test eax, eax
je 0x30054a20
call fcn.30053ed8
test eax, eax
je 0x30054a20
lea eax, [ebp - 0x104c]
push esi
push eax
call fcn.30053a44
lea ecx, [ebp - 0x2094]
push ecx
push 1
push eax
call fcn.30053c54
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x300549c8
lea eax, [ebp - 0x104c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x30054a20
mov eax, dword [0x300a3990]
test eax, eax
je 0x300549e5
push eax
call fcn.30053354
and dword [0x300a3990], 0
and dword [0x300a3994], 0
lea eax, [ebp - 0x104c]
push eax
call fcn.3004dd60
inc eax
mov dword [0x300a3994], eax
push 0x11a
add eax, eax
push eax
call fcn.3005343f
test eax, eax
mov dword [0x300a3990], eax
je 0x30054a20
push dword [0x300a3994]
push eax
lea eax, [ebp - 0x104c]
push eax
call fcn.3004f088
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.30062195
leave
ret
Function at 0x3005539e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 0x30014d94
mov edi, 0x20019
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push edi
push ebx
push dword [eax]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x30055414
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x30055414
push dword [ebp + 0x1c]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x30055414
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x30055414
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], ebx
je 0x30055425
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x30055436
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], ebx
cmp dword [ebp - 0x10], ebx
jne 0x3005544c
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], 0x30014d9c
jl 0x300553c4
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x30055454
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor esi, esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push esi
mov ebx, 0x20006
push ebx
push esi
push esi
push esi
push 0x30014d9c
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x300554c8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x300554c8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x300554c8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x300554d8
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], esi
je 0x300554e2
push dword [ebp - 8]
call edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3005555c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [section..cdata]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], eax
push esi
je 0x30055692
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x30055692
push edi
mov edi, dword [ebp + 0x20]
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x400
push eax
mov dword [ebp - 0x40c], 1
mov dword [esi], ebx
call fcn.30058df5
mov dword [ebp - 0x408], eax
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x408], ebx
je 0x300555da
push dword [ebp - 0x408]
mov eax, edi
shr eax, 0x17
and eax, 1
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [esi], eax
cmp dword [esi], ebx
jne 0x30055651
mov eax, edi
shr eax, 0x1a
not eax
test al, 1
je 0x30055651
lea eax, [ebp + 0x1c]
push eax
push edi
call fcn.30058faf
test eax, eax
je 0x3005563c
push dword [ebp - 0x408]
mov eax, edi
shr eax, 0x19
and eax, 1
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea eax, [ebp + 0x1c]
push eax
push edi
call fcn.30058d9d
cmp ebx, 5
jne 0x3005563c
cmp dword [ebp + 8], 0
jne 0x3005563c
mov dword [ebp + 8], 1
xor ebx, ebx
jmp 0x300555b6
cmp dword [esi], 0
je 0x3005564f
xor eax, eax
cmp ebx, 0xb7
setne al
mov dword [ebp + 0xc], eax
xor ebx, ebx
mov eax, dword [esi]
cmp eax, ebx
pop edi
je 0x3005565d
cmp eax, 0xffffffff
jne 0x30055668
mov dword [esi], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x40c], ebx
cmp dword [ebp + 0x10], ebx
je 0x3005567e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x408]
call fcn.3004f0aa
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x3005568a
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40c]
jmp 0x30055694
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.30062195
leave
ret 0x1c

Function at 0x300559b2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x300bb9fc], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x300559f6
call ebx
test eax, eax
jns 0x300559ec
push 0x30014e88
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x30014e7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x300bb9f8], eax
mov dword [0x300bb9fc], 1
mov eax, dword [0x300bb9f8]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x30055a12
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x30055a42
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x30055a38
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x30055a2c
push dword [eax + 8]
call dword [eax]
jmp 0x30055a32
push dword [eax + 0xc]
call dword [eax + 4]
test eax, eax
je 0x30055a41
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x30057e7b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
cmp si, 0xffff
push edi
je 0x30057f00
test si, 0x3ff
je 0x30057f00
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.30057dfc
add esp, 0xc
test eax, eax
jne 0x30057f0c
xor ebx, ebx
push ebx
push ebx
movzx edi, si
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x58
push edi
call esi
test eax, eax
je 0x30057ef3
push 0x20
lea eax, [ebp - 0x20]
push eax
push 0x58
push edi
call esi
push 3
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], ebx
call fcn.30057d75
add esp, 0xc
test eax, eax
je 0x30057ef3
mov al, byte [ebp - 0x40]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x30057f0c
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x30057f0c
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 0x10]
and dword [eax], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x300591f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x3005920d
test al, 0x10
je 0x3005920d
xor eax, eax
inc eax
jmp 0x3005920f
xor eax, eax
ret 4

Function at 0x30059212
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..cdata]
push esi
push edi
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.3004f088
mov edi, eax
lea eax, [edi - 2]
cmp word [eax], 0x5c
jne 0x3005924a
mov edi, eax
and word [edi], 0
lea eax, [ebp - 0x20c]
cmp edi, eax
mov esi, edi
jbe 0x30059285
cmp word [esi], 0x5c
jne 0x30059270
and word [esi], 0
lea eax, [ebp - 0x20c]
push eax
call fcn.300591f6
test eax, eax
jne 0x3005927e
dec esi
dec esi
lea eax, [ebp - 0x20c]
cmp esi, eax
ja 0x30059256
jmp 0x300592a4
mov word [esi], 0x5c
jmp 0x300592a4
cmp word [esi], 0
jne 0x300592a2
push 0
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
je 0x300592b9
mov word [esi], 0x5c
inc esi
inc esi
cmp esi, edi
jbe 0x30059285
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.30062195
leave
ret 4
xor eax, eax
jmp 0x300592ab
Function at 0x30062195
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [section..cdata]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.30062195
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [section..cdata]
jne 0x3006206d
ret
Function at 0x30062254
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x30016148
call fcn.30062021
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x30062294
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x30062294
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x300622ac
cmp eax, 0x20b
je 0x30062299
mov dword [ebp - 0x1c], ebx
jmp 0x300622c0
cmp dword [ecx + 0x84], 0xe
jbe 0x30062294
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x300622ba
cmp dword [ecx + 0x74], 0xe
jbe 0x30062294
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x300bcf08], 0xffffffff
or dword [0x300bcf0c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x300bbae4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x300bbae0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x300bcf04], eax
call fcn.30062496
call fcn.30062701
cmp dword [0x300960bc], ebx
jne 0x30062320
push 0x300626fe
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.300626ec
push 0x3006501c
push 0x30065018
call sub.MSVCRT.dll__initterm
push 0x300624da
call fcn.30062484
mov eax, dword [0x300bbadc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x300bbad8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x30062374
push 8
call sub.MSVCRT.dll__amsg_exit
pop ecx
push 0x30065014
push 0x30065008
call sub.MSVCRT.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x300623f2
cmp al, bl
je 0x3006239e
cmp dword [ebp - 0x20], ebx
jne 0x300623f2
mov al, byte [esi]
cmp al, bl
je 0x300623ae
cmp al, 0x20
ja 0x300623ae
inc esi
mov dword [ebp - 0x24], esi
jmp 0x3006239e
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x300623ca
movzx eax, word [ebp - 0x54]
jmp 0x300623cd
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.30019a1d
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x300623ea
push esi
call dword [sym.imp.MSVCRT.dll_exit]
call dword [sym.imp.MSVCRT.dll__cexit]
jmp 0x30062447
cmp al, 0x22
jne 0x30062401
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCRT.dll__ismbblead]
pop ecx
test eax, eax
je 0x30062414
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x3006238c
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.3006205c
ret
Function at 0x40e9b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x5c1470], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5c146c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5c1470], edx
cmp eax, 0x26f
jl 0x40e9c0
mov dword [0x554f80], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x40ea00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5c1474]
mov ebx, dword [eax*4 + 0x5c1470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5c1aa4]
mov dword [eax*4 + 0x5c1470], edx
cmp eax, 0xe2
jl 0x40ea10
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5c1474]
mov ebx, dword [eax*4 + 0x5c1470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5c10e4]
mov dword [eax*4 + 0x5c1470], edx
cmp eax, 0x26e
jl 0x40ea60
mov edx, dword [0x5c1470]
mov ecx, dword [0x5c1e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5c1aa0]
mov dword [0x5c1e2c], eax
mov dword [0x554f80], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40eaf0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x554f80]
add dword [0x554f80], 1
mov eax, dword [0x5c0020]
cmp eax, dword [0x5546d0]
jne 0x40eb16
cmp ebx, 0x271
jb 0x40eb38
mov eax, dword [0x5c0020]
call fcn.0040e9b0
not dword [0x5c0020]
mov eax, dword [0x5c0020]
mov dword [0x5546d0], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x40eb54
call fcn.0040ea00
xor ebx, ebx
mov dword [0x554f80], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5c1470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410780
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x554440]
cmp ax, 0xcb
je 0x41088c
cmp ax, 0xcc
je 0x41088c
mov edx, dword [0x5c2070]
test edx, edx
je 0x4107b5
mov eax, dword [0x5c1f20]
call edx
mov ebx, eax
jmp 0x4107ba
mov ebx, 0x5c1f24
cmp word [0x5c1f10], 0
jle 0x4107e0
mov eax, 0x5c1ef0
call fcn.00410a00
mov eax, ebx
call fcn.00410300
mov eax, ebx
call fcn.00410380
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410802
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4107fd
mov edx, edi
mov eax, ebx
call fcn.0040f750
jmp 0x410800
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4107e8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5c1f10], 0
jle 0x41088c
mov edx, 0x5c1e30
mov eax, ebx
call fcn.0040f8a0
mov edi, eax
test edi, edi
je 0x41085c
mov eax, dword [0x5c1ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5c1ec4], 0
je 0x410850
mov eax, dword [0x5c1ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5c1ec4], eax
nop
sub word [0x5c1f10], 1
cmp word [0x5c1f10], 0
sete bl
mov eax, 0x5c1ef0
call fcn.00410a20
test bl, bl
je 0x41088c
mov eax, 0x5c1ef0
call fcn.004109f0
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412d40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5c1260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00412f20
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5c1260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403480
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5544b0], eax
mov ebx, eax
jmp 0x412ee3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x412dc8
cmp byte [ebx], 0
je 0x412eec
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x412e43
mov al, byte [ebx]
cmp al, 1
jb 0x412e38
sub al, 0x20
jbe 0x412e08
sub al, 2
je 0x412e1c
jmp 0x412e38
mov al, byte [ebp - 0x114]
test al, al
je 0x412e48
add dword [ebp - 0x110], 1
jmp 0x412e40
cmp byte [ebx + 1], 0x22
je 0x412e33
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x412e40
add ebx, 1
jmp 0x412e40
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x412df8
test dword [ebp - 0x10c], 0xffffffff
je 0x412edc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00412f20
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5c1260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x412ed3
mov al, byte [ebx]
cmp al, 1
jb 0x412ec8
sub al, 0x20
jbe 0x412e98
sub al, 2
je 0x412eac
jmp 0x412ec8
mov al, byte [ebp - 0x114]
test al, al
je 0x412ed8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x412ed0
cmp byte [ebx + 1], 0x22
je 0x412ec3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x412ed0
add ebx, 1
jmp 0x412ed0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x412e88
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x412dcb
mov ebx, dword [ebp - 0x10c]
mov dword [0x5c1250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5c1260
call fcn.004105b0
mov eax, dword [0x5c1260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret