joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x67bf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5051b1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x5050d7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x505076
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5050e3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x5050a1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5050e3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x5050e3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call sym.net.favoriteAddrFamily
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call sym.net.socket
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.net.internetSocket
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x402ee4
pop dword [ebp - 0x10]
mov eax, 0x77ab6d1
sub eax, 0x73a87ed
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x25839b39
sub dword [ebp - 0x20], 0xd73155ee
mov dword [ebp - 0x1c], 0xc3219677
sub dword [ebp - 0x1c], 0x90ee4a32
mov dword [ebp - 0x18], 0xaa0cc101
sub dword [ebp - 0x18], 0x5dc07cd3
mov dword [ebp - 0x14], 0xaa16762b
sub dword [ebp - 0x14], 0xaa16762b
lea eax, [ebp - 0x20]
push eax
mov eax, 0xefef890d
add eax, 0x1050f7f7
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x2666ceae
sub dword [ebp - 0x20], 0xb1f46558
mov dword [ebp - 0x1c], 0x487a3f0f
sub dword [ebp - 0x1c], 0x70ddd9a
mov dword [ebp - 0x18], 0xe0fbd456
sub dword [ebp - 0x18], 0x7d8c67ea
mov dword [ebp - 0x14], 0x1fe8832a
sub dword [ebp - 0x14], 0x1fe8832a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x2308dbf3
sub eax, 0x22c85af3
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x37273
push 0
call eax
mov ecx, 0xe2bc2916
add ecx, 0x1d441f62
mov edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x10]
mov edx, 0xfefc5b6d
sub edx, 0x8fcd7d38
add dword [ebp - 8], esi
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0x26270ff7
xor esi, edx
sub dword [ebp - 4], eax
mov dword [edi], esi
xor dword [ebp - 8], 0x961f0e08
add edi, 0x584bcdd8
sub edi, 0x584bcdd4
add ebx, 0x550d0522
sub ebx, 0x550d051e
loop 0x403000
add eax, 0x114b3
xor ebx, ebx
add ebx, eax
add eax, 0x21eeaeee
sub eax, 0x21eeaee9
mov ecx, 0xc7a9a03e
add ecx, 0x38965fc2
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x401390
Capabilities:
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [0x406008]
test eax, eax
je 0x4014e8
lea edx, [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.user32.dll_wvsprintfW]
mov edx, dword [section..data]
sub esp, 0xc
mov esi, eax
test edx, edx
jne 0x4014a0
mov ebx, dword [0x406004]
mov dword [ebp - 0x10], 0
mov dword [section..data], 0
test ebx, ebx
je 0x401560
mov edi, dword [0x406008]
call dword [sym.imp.kernel32.dll_GetOEMCP]
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0x40404e
mov dword [esp + 0x14], pe_overlay
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, dword [0x406004]
sub esp, 0x20
mov ebx, eax
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea edx, [ebp - 0x14]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov eax, dword [section..bss]
test eax, eax
jne 0x40148d
test byte [0x403004], 8
jne 0x4015a0
mov dword [section..bss], 1
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x406008]
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea edx, [ebp - 0x14]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x4013d0
jmp 0x40146d
mov dword [esp + 8], 0x1fffe
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [0x406008], eax
sub esp, 0xc
test eax, eax
jne 0x4013a6
test byte [0x403004], 1
jne 0x401530
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Out_of_memory___could_not_allocate_2_x_64_KB_buffers_n
mov dword [esp + 8], 0x4040e8
mov dword [esp + 4], 0x403004
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
jmp 0x401528
mov dword [esp + 8], pe_overlay
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [0x406004], eax
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x40151d
jmp 0x4013ef
mov eax, dword [section..data]
mov dword [esp + 0xc], str.Writing_to_console____d__n
mov dword [esp + 8], 0x4040e8
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x403004
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401483
Function at 0x4019a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, 0xc
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x2a0
mov dword [ebp - 0x290], 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x290]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.iphlpapi.dll_GetUdpTable]
sub esp, 0xc
mov edi, eax
test eax, eax
jne 0x401b20
mov eax, dword [ebx]
test eax, eax
je 0x401af4
lea esi, [ebp - 0x24c]
lea esi, [esi]
mov eax, dword [ebx + edi*8 + 4]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_htonl]
sub esp, 4
movzx edx, al
mov dword [esp + 0x18], edx
movzx edx, ah
mov dword [esp + 0x14], edx
mov edx, eax
shr eax, 0x18
shr edx, 0x10
mov dword [esp + 0xc], eax
movzx edx, dl
mov dword [esp + 8], 0x40446c
mov dword [esp + 0x10], edx
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], esi
call sym._swprintf
movzx eax, word [ebx + edi*8 + 8]
add edi, 1
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_htons]
sub esp, 4
movzx eax, ax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28c]
mov dword [esp + 8], 0x404484
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x28c]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 8], str._s:_s
mov dword [esp + 4], 0xa0
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x14c]
mov dword [esp + 4], 0x404498
mov dword [esp + 8], eax
mov dword [esp], str.____6s___22s_:_n
call sym._NETSTAT_wprintf
cmp edi, dword [ebx]
jb 0x401a20
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp edi, 0x7a
jne 0x401b18
mov eax, dword [ebp - 0x290]
jmp 0x4019c2
Function at 0x402510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402568
cmp byte [esi + ebx - 1], 0xa
je 0x40253c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4070a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x4070b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x402cd0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4070b4]
movzx eax, al
bt eax, esi
jae 0x402d30
mov ecx, dword [0x4070a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x402bd5
test byte [0x40301c], 8
jne 0x402c70
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x40302c], 8
jne 0x402c20
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402ba4
cmp esi, 3
jbe 0x402be0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4045a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x402ba4
mov ecx, dword [0x4070b4]
test ecx, ecx
je 0x402d10
mov dword [esp], 0x40302c
call dword [0x4070b4]
test al, 8
je 0x402b7b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x402b7b
mov ebx, dword [0x4070b4]
test ebx, ebx
je 0x402cf0
mov dword [esp], 0x40301c
call dword [0x4070b4]
test al, 8
je 0x402b66
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x402b6e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4070b4
call sym._load_func.part.0
jmp 0x402b2d
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4070b4
call sym._load_func.part.0
jmp 0x402c7a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4070b4
call sym._load_func.part.0
jmp 0x402c2e
mov eax, 0xffffffff
jmp 0x402bd5
Function at 0x402e90
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40345b
pop dword [ebp - 0x44]
mov eax, 0xaab3e2d9
sub eax, 0xaa73ae7e
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x23a10b76
sub dword [ebp - 0x54], 0xd54ec62b
mov dword [ebp - 0x50], 0x41619405
sub dword [ebp - 0x50], 0xf2e47c0
mov dword [ebp - 0x4c], 0x2f3f46cb
sub dword [ebp - 0x4c], 0xe2f3029d
mov dword [ebp - 0x48], 0x461dba67
add dword [ebp - 0x48], 0xb9e24599
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xa1f7f353
add dword [ebp - 0x54], 0xd27a7603
mov dword [ebp - 0x50], 0xa6297433
sub dword [ebp - 0x50], 0x64bd12be
mov dword [ebp - 0x4c], 0xb3f77ab5
sub dword [ebp - 0x4c], 0x50880e49
mov dword [ebp - 0x48], 0x4ebe9d7f
sub dword [ebp - 0x48], 0x4ebe9d7f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x73d488b
sub eax, 0x6fd083b
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x392af
push 0
call eax
mov ecx, 0xc4ebcc96
add ecx, 0x3b1484a0
xor edx, edx
add edx, eax
mov edi, 0xa6e7082a
add edi, 0x59597bd6
add edi, dword [ebp - 0x44]
mov esi, 0xd5f0093f
add esi, 0xbc0ca0d0
xor dword [ebp - 0x30], 0x31a2af2e
mov ebx, dword [edi]
sub ebx, esi
xor dword [ebp - 0x28], eax
mov dword [edx], ebx
add edx, 0xd1cae61d
sub edx, 0xd1cae619
add edi, 0x6642a4ac
sub edi, 0x6642a4a8
loop 0x40357a
add eax, 0x137ab
mov ebx, eax
add eax, 0x3f084d5
sub eax, 0x3f084d0
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x2a30dd20
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a353dc6
call fcn.2a302657
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30de11
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30ddca
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30ddc7
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30dd8e
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30ddf1
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30de46
test di, di
jne 0x2a30de43
push esi
push dword [ebx + 0x18]
call fcn.2a3456e5
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30de46
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a3456e5
xor ecx, ecx
jmp 0x2a30de46
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30decd
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a3456e5
mov edi, dword [0x2a36bb18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36bb0c]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a35835c]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [0x2a35835c]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a3456e5
cmp dword [ebp - 0x14], 0
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a3456e5
test al, al
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33ed32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a3456e5
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30def1
mov eax, dword [0x2a36b7ac]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [0x2a35835c]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30df25
push eax
mov eax, dword [0x2a36bb38]
cmp word [ebx + 0x196], cx
je 0x2a30df0f
mov esi, dword [eax + 0x124]
jmp 0x2a30df15
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [0x2a35835c]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302bc2
ret
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a3456e5
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a3456e5
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a3456e5
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a3456e5
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a3456e5
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a3456e5
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10