joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8d3b
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xac
adc dword [edi + 0x33], esi
ja 0x4a8d8b
jb 0x4a8da6
ljmp 0x9f40:0xf040ba54
sbb al, 0xaf
xor byte [eax], 0xf9
outsd dx, dword [esi]
jae 0x4a8d24
add al, 0xa9
sbb dl, byte [ecx + edi*8 + 0x6e]
ret 0xc6b1
das
add dh, al
shr ch, 1
das
or dword [eax - 0x2f77d487], esi
ljmp 0xf9f8
push esi
pop es
pop ebx
aas
out dx, eax
fldenv [ebx]
push esi
and byte [esi], 0xad
mul byte [ecx + 0x768330f7]
neg bh
mov edi, 0xe69313e2
sbb al, byte [ebp + ebp - 0x58f9de06]
stosb byte es:[edi], al
inc edi
xor al, 0xac
jns 0x4a8dec
xchg edi, eax
retf
mov eax, dword [0xbb2e0d06]
xchg ebx, eax
cld
loop 0x4a8e37
mov al, byte [eax]
push esi
xor byte [ebp - 0x69aa32a], cl
adc byte [esi + 0x5c113d0c], ah
pushal
aad 0x9d
sbb esp, esp
adc eax, 0x76e9e06b
dec ebp
invalid
pop eax
std
mov esp, dword [eax + edx*2 - 0x3f]
or byte [esi - 0x33807ea1], bl
push es
push ebx
out 0xdd, al
daa
inc ebp
cmp byte [esi + 0x765a7660], al
lodsb al, byte [esi]
mov esi, 0x8e8ab360
sub eax, 0xa8fae904
jb 0x4a8ed4
fld qword [esi]
sal dword [ebp + 0x600095fd], 0x7f
ja 0x4a8eae
inc eax
cli
sub eax, dword [0x2173a81f]
invalid
movsb byte es:[edi], byte [esi]
lcall 0x65e6, 0x50365f4b
fadd qword [ecx + 0x37]
add byte [esi], 0
jmp 0x4a8ef5
mov ch, bl
inc ecx
mov ch, 0x80
xchg byte [edx + ecx*4 - 0x1a], dh
cmp ebp, dword [ebx - 0x6df16dca]
xor eax, 0x1b6ac20a
jno 0x4a8e85
cmc
inc edx
xchg esp, eax
fsetpm
test eax, 0x8c7807da
sub edx, dword [ebx - 0x422c6e16]
test dword [0x3cc4cdc5], esp
mov edx, 0x371ce4a0
lcall 0x4250, 0x7fce42b4
mov ebp, 0xcdc52585
les edi, [edx + edi*4]
mov al, byte [0x36371ce4]
lcall 0x4250, 0x7fce42b4
inc edx
xor byte [edx - 0x1e], bl
popal
jo 0x4a8f44
stc
invalid
xchg ebp, eax
cmc
mov dword [0x7740eee1], eax
ja 0x4a8f23
loopne 0x4a8f77
push edx
dec eax
xchg byte [ebx + ebx - 0x19], dl
add eax, 0xe825fe3e
pushal
inc eax
xchg ebx, eax
shl al, 1
push ss
mov ebx, 0x8154463e
fdiv qword [ebp - 0x4e]
xlatb
mov ecx, 0x46b8a290
outsd dx, dword [esi]
pop esi
invalid
Function at 0x53bdd3
Capabilities:
Encode data using xor

Disassembly:
neg edi
or dword [0x23db], ebp
fnstenv [esi + 0x72eb7029]
sub dword [eax - 0x15], esi
jb 0x53be35
sub dword [eax - 0x15], esi
jb 0x53be35
js 0x53bdca
cmp dword [ebx], edx
dec esi
inc esp
imul dword [0x719e454e]
sub eax, 0xf27a8ee7
stosd dword es:[edi], eax
sbb byte [ebx + 0x12], ah
sbb ch, byte [edi - 0x22]
jno 0x53be4d
pop eax
invalid
adc al, byte [ebp - 0x676b4930]
lahf
jnp 0x53be57
mov edi, 0xd7f07513
xchg byte [ebx - 0x5763ee68], al
int1
iretd
cmp byte [eax - 0x7c], 0x70
push eax
pop eax
xor esp, dword [ebx - 0x80]
xor eax, 0x57afdeb8
in al, dx
xor byte [0x57afdeb8], 0xec
and dword [eax - 8], esi
mov byte [eax - 0x34cddbc4], ah
cmp al, 0x24
xor cl, bl
mov dh, 0x85
push esp
jb 0x53be41
call 0x3373fc5b
and byte [ebx], dh
and dword [edx + 0x720654aa], edx
arpl word [ebx + 0x1353cf21], ax
shr dword [ecx], 1
fidiv word [ecx]
dec edx
inc eax
and edi, ecx
push ebx
adc edx, ecx
sub esi, ebx
xor dword [edx + 0x40], ecx
jbe 0x53be2d
sahf
xlatb
popal
xor dword [eax + esi], 0xffffff9d
js 0x53bea8
rcl byte [ebx - 0x31ba79dd], 0x53
jb 0x53be15
and ecx, edx
aad 0x96
xor esp, ecx
inc eax
int3
add cl, byte [edx + 0x5e6836c0]
movsb byte es:[edi], byte [esi]
invalid

Function at 0x53c797
Capabilities:
Encode data using xor

Disassembly:
div ebx
or al, byte [ebp - 0x7a]
push ecx
stc
loop 0x53c7f4
fcom qword [ecx - 0x1a]
inc esi
cmp al, 0xea
cmc
retf
push edx
mov eax, dword [0xb16f0e8d]
fstp xword [edi - 0x545bb2b2]
pop ss
std
mov al, byte [0x6fbd7874]
invalid
Function at 0x5c1315
Capabilities:
Access peb ldr_data

Disassembly:
in al, 0
add byte [eax], al
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005ca8d2
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5c18c5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.005ca8d4
mov dword [esp + 0x28], 0
test esi, esi
jne 0x5c190b
xor eax, eax
jmp 0x5c190e
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.005caf09
lea eax, [edi + 0x7c]
test eax, eax
je 0x5c1929
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.005cb26e
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x5c1967
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.005cb26e
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.005ca5ee
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005caf8a
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ca5ee
Capabilities:
Encode data using xor

Disassembly:
mov bh, al
add al, byte [edi]
rcl esp, 0x1e
mov ebp, 0x7317c6ac
pop ss
jae 0x5ca604
push 0xffffffffffffffd5
pop ss
jae 0x5ca604
push 0xffffffffffffffd5
std
jne 0x5ca5e4
and byte [ebx - 0x5b984f01], dh
aad 0xdb
and eax, 0x49a1f3
mov cl, 0x6c
insb byte es:[edi], dx
lodsd eax, dword [esi]
xchg esi, eax
invalid
Function at 0x5cf2a8
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
pop ebp
pop ss
lds eax, [eax + 0x16]
invalid
inc edx
popal
mov gs, word [edx + 0x5b90ba9e]
dec ebx
dec edi
imul dword [ebx + 0x4b]
rol edx, 1
jnp 0x5cf2cd
add dword [edi - 0x17], esi
ret
ret
idiv byte [esi - 0x421dc450]
jg 0x5cf24d
ja 0x5cf22d
out dx, al
mov ecx, esi
push edi
jbe 0x5cf254
int1
imul ebp, dword [edx - 0x12], 0xffffffb2
pop es
xor al, 0x12
add esi, dword [0xd2f65314]
adc al, byte [ebx]
xor eax, 0xd2f65314
jb 0x5cf241
retf
push ebx
pop edi
pop esp
xchg esi, eax
dec eax
cmp byte [edx], al
dec edx
and esp, dword [ecx]
nop
ja 0x5cf2b5
scasb al, byte es:[edi]
dec edi
bound ebp, qword cs:[esi - 0x4660b625]
mov esp, dword [edx - 0x5d]
mov bl, 0x17
xchg dword [ebp - 0x59], edi
inc edi
daa
inc edi
mov esi, 0x57061687
pop esp
test byte [ebx], bh
jecxz 0x5cf289
sal byte [edx], 0x44
xchg ebx, eax
aas
pop eax
lodsd eax, dword [esi]
add byte [ebx - 0x7f386c4c], 0x85
xchg ecx, eax
jne 0x5cf34f
aas
xchg ebx, eax
or dword [edx], esp
sub edx, dword [esi + 9]
jl 0x5cf29d
adc eax, 0xbcb10f12
invalid
daa
xchg esi, eax
movsb byte es:[edi], byte [esi]
inc ebx
mov dword [ecx - 0x1a], 0x68523740
jecxz 0x5cf3ac
bound eax, qword [edi]
add al, 0x5d
push ss
adc eax, 0xf6303b29
ret
out 0xb3, eax
xchg esi, eax
mov dh, 0xe0
ja 0x5cf3b5
xchg ebx, eax
sti
mov al, 0x23
pop ss
frstor dword [edi - 0x3b]
pushfd
mov al, 0x76
loope 0x5cf344
xchg ecx, eax
lds edx, [ebx - 0x5c57fd6a]
mov dh, 0xa3
inc esp
adc eax, 0x5d2be77e
jns 0x5cf407
inc esp
sub dword [edx - 0x4849d2f9], esp
cmpsd dword [esi], dword es:[edi]
xchg dword [edi], ebx
arpl word [eax], dx
mov byte [0xeaf0d10d], al
push cs
mov eax, dword [0xa61aa787]
push ss
mov al, 7
pop edx
inc ebp
pinsrw mm0, word [esi + ebp*4], 0xae
mov ch, 0xe0
xchg edi, eax
adc eax, 0x33812335
out 0xd2, eax
mov edi, 0xae79b5fe
xchg edi, eax
inc dl
adc edi, edi
push edi
mov bh, 0x3d
inc ebx
mov eax, dword [0x50feaf49]
ja 0x5cf3b7
call dword [edi - 0x49]
cmp eax, 0xaf49a143
invalid
adc dl, bh
cli
lcall 0xa456, 0x943
out 0xd7, eax
fadd qword [ebx]
invalid

Function at 0x5d80c8
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
jae 0x5d813a
inc edx
imul esp, dword [esi], 0x6bffb364
sub dword [edx - 0x43], 0x56cf60dd
adc esi, dword [edi + 0x5320e8cc]
Function at 0x5e8bbe
Capabilities:
Encode data using xor

Disassembly:
push es
lodsd eax, dword [esi]
retf 0x1a69
mov byte [esi], 0xb7
mul byte [edi]
daa
loopne 0x5e8bae
daa
imul eax, dword [eax + edi*4], 0x32
xchg esp, eax
adc cl, byte [eax - 0x55]
jne 0x5e8c4b
aaa
dec edx
inc ebx
cmp ah, byte [edx]
daa
mov ebp, dword [esi]
sbb eax, edx
xor eax, 0xfbc02a0a
fild word [ebx - 0x3c49f551]
fild word [edi]
cmpsd dword [esi], dword es:[edi]
mov dh, 0x53
push edi
inc ebp
dec edx
mov bl, 0x14
jb 0x5e8bc2
xchg edx, eax
xlatb
clc
xor byte [edx + 0x4f9d177], 0xba
fdivr st(2), st(0)
int1
rcl ch, cl
jmp 0x2da71c7
ret 0xbab9
inc eax
jb 0x5e8c5c
shr dl, cl
mov al, byte [0xab60e12e]
sahf
shl dword [eax + 0x67], 0x32
and esi, ebx
imul ebp, dword [edx], 0xe1969ac5
ficom word [edi]
xchg esi, eax
loope 0x5e8c41
pop ss
xor bl, byte [esi]
salc
cli
cmpsd dword [esi], dword es:[edi]
jo 0x5e8c60
and al, 0x6a
pop eax
add esp, dword [ebp + 0x7a]
into
and esp, dword [0x4ae2]
movsb byte es:[edi], byte [esi]
cmp byte [ebx - 0x56], ch
add ch, bh
push ds
push ecx
shr dword [bp + di + 0x5dff], cl
int 0x6c
and byte [0x6927a850], dh
mov eax, dword [0x409c3e89]
pop ebp
ficom word [ecx + 0x4340e570]
pop esi
rol byte [esi], cl
ret 0xdba7

Function at 0x60bb19
Capabilities:
Encode data using xor

Disassembly:
salc
push eax
mov bl, 0x29
je 0x60bae9
fcomi st(7)
fcom dword [ecx - 0x78467869]
rol byte [0x6b1bf7be], 6
pushfd
neg dword [ebx]
imul eax, dword [esi], 0xffffff9c
jp 0x60bb13
inc ebp
dec ecx
sub dword [ebp + 0x200b0352], edi
mov eax, dword [0xf4d5171d]
fadd dword [esi]
mov al, ah
push ecx
xchg ebx, eax
movsb byte es:[edi], byte [esi]
push 0x619def3b
popal
or dword [ebp - 0x2b9ed7ea], esp
lea esp, [esi + 0x181cf846]
inc esi
clc
sbb al, 0x18
xor bl, byte [eax]
mov ebx, 0xc9205207
cmp esp, dword [ebx - 0x68]
add eax, dword [edi + 0x51]
push cs
push dword [eax + 0x7aa9666d]
and eax, 0x9378a257
dec ebp
jne 0x60bb0a
add al, 0x75
loopne 0x60bad8
and al, 0x71
adc esi, dword [ecx - 0x182e2b75]
jmp 0x60bb82
mov esi, 0xe8e58981
cmp al, 0xf4
jecxz 0x60bbb2
sbb dword [ecx + 0x46], ebx
invalid
int3

Function at 0x616456
Capabilities:
Encode data using xor

Disassembly:
call 0x50228c16
mov ecx, 0x39f52904
fnstenv [eax]
arpl si, sp
push 0x4c42390c
xor edi, dword [esi + ecx*8 - 0x4ceeeef7]
enter 0x7d2b, 0xffffffffffffffa4
cmp eax, 0x6aaf72c5
add eax, 0xaa7caf29
movsb byte es:[edi], byte [esi]
pop esp
stc
movsd dword es:[edi], dword [esi]
sbb byte [ebx - 0x78f84407], ch
xchg esi, eax
outsd dx, dword [esi]
sub eax, ebp
sub bh, dh
invalid
Function at 0x61e162
Capabilities:
Encode data using xor

Disassembly:
pop eax
insb byte es:[edi], dx
push esp
inc edx
cmpsd dword [esi], dword es:[edi]
mov ah, byte [esi + 0x3f3986cf]
cmp byte [ecx], bh
xchg ebx, eax
mov edx, 0xe2fb0fb
das
push cs
aas
and dword [edi], ecx
fldenv [eax - 0x15432a19]
cmp edi, edx
cwde
or byte [eax - 0x2ea858b9], cl
cmpsd dword [esi], dword es:[edi]
push edi
rcr dword [edx], 1
outsb dx, byte [esi]
invalid
popfd
jp 0x61e1d8
cmpsd dword [esi], dword es:[edi]
push edi
rcr dword [edx], 1
outsb dx, byte [esi]
sub eax, 0xc26d7a9d
pop ss
mov esi, dword [eax]
out dx, eax
mov edx, dword [ebp - 0x26e22a66]
aam 0xcc
wait
daa
in eax, dx
xor bh, ch
out 0x5e, eax
jno 0x61e13f
ret 0x8b17
dec edx
mov ecx, 0x45a96e85
bound ebx, qword [edi + 0xd3b8189]
mov ebx, 0x730f1cef
xor bh, al
jecxz 0x61e150
into
or ebx, eax
cmp cl, byte [ebx]
std
out dx, eax
cmp eax, 0xb46d5c0d
pushal
jb 0x61e197
mov word [esi + edx*4 + 0x13], es
mov dword [edi - 0xf87eba7], 0x1438f749
nop dword [edx + 0x98418e3]
mov al, 0xfd
sbb al, 0x35
or bh, byte [esi]
mov bh, 0x30
xlatb
cmp dword [ebx - 0x5f], esp
push eax
push 0xbb801280
retf
retf

Function at 0x61e296
Capabilities:
Encode data using xor

Disassembly:
loope 0x61e30f
mulps xmm2, xmmword [ecx]
invalid
lodsd eax, dword [esi]
dec esi
imul ebx, dword [ecx + 0x36912944], 0x3dd8e09
and eax, dword [eax + ebp - 0x25]
stc
xchg edx, eax
jmp 0x6a6f46d5
Function at 0x61e783
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx + ebx*2 + 0x349629a5], ebp
scasd eax, dword es:[edi]
mov eax, 0xe3b67bff
adc ebx, dword [eax + 0x4f]
les ebp, [edi]
push 0x6f
arpl word [eax + 0x44], dx
pushal
call 0x874cdf9d
mov esi, 0x71d7d34
int 0x1f
sub eax, 0x499778aa
sbb eax, 0x3f939033
xor dword [esi - 0x6fb1e7da], ebp
ficom dword [ebx + ecx]
add cl, cl
enter 0xffffffffffffe6ea, 0xffffffffffffffa6
sbb byte [edx + ebx], bh
push es
sbb al, byte [esi]
sub dh, byte [ebx]
xor ebx, dword [edx + 0x66e6d3d9]
mov ah, 0xe4
ja 0x61e679
test byte [ebx + 0x2e776345], bh
in al, 0x1f
cwde
xor ebp, edi
jle 0x61e6b9
sti
fistp qword [edi + 0x6bcfafb1]
xor eax, 0xc4b904f2
or ebp, edx
push 0x99119db0
mov al, 0x9d
adc dword [ecx + 0x496e855f], ebx
wait
jnp 0x61e71e
mov ch, 0xef
ja 0x61e6b2
sbb dword [ecx - 0x658c043], edx
scasb al, byte es:[edi]
insb byte es:[edi], dx
lahf
nop
dec edx
adc byte [ebp - 0x5a6531b3], cl
stc
lcall 0x6023, 0xbcffbe57
rol edi, 0xbf
in eax, 0xde
lahf
jb 0x61e721
fcomp dword [edi - 0x77]
xor ch, cl
sub dword [ebp - 0x8b68ee9], edx
or ah, 0x7c
jnp 0x61e7a7
nop
cwde
jnp 0x61e6d5
and dl, byte [eax - 0x2f]
fnstcw word [eax + 0x2ff11d6f]
pop ebp
inc edx
call 0x1e23949b
or esi, dword [ebp - 0x47]
pop ecx
imul ebp, ebp, 0xffffffea
mov dl, 0xba
sub eax, dword [ebx - 0x16]
test dword [ebp + 0x5dfa7dfb], edx
pop esi
mov bl, 0x5d
mov byte [ebx], ah
xor ch, byte [esi - 0x5e6300cf]
push es
insb byte es:[edi], dx
mov al, byte [0x81bf0d10]
dec esp
insd dword es:[edi], dx
in eax, dx
pop ebp
mov edi, 0xdbdb7b2b
dec eax
jl 0x61e746
outsd dx, dword [esi]
fild word [eax]
fimul dword [ebp - 0x13]
cmp byte [ebp + 0xb], al
jmp 0xab14377
insd dword es:[edi], dx
imul edi, dword [ecx + 0x72], 0xffffff9d
sub eax, 0x223beb8d
daa
xor ebp, dword [eax - 0x4b00e706]
fnstsw word [eax]
popal
salc
ret 0x9cdd
Function at 0x30006ee6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
jne 0x30006f0c
mov dword [ebp - 4], 0x80070057
jmp 0x30007011
push ebx
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
mov ebx, 0x300115a8
ja 0x30006f31
mov dword [ebp - 4], 0x80004005
jmp 0x30006fcc
lea eax, [edi + 1]
push eax
call fcn.3000d824
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 8], esi
jne 0x30006f4d
mov dword [ebp - 4], 0x8007000e
jmp 0x30006fcc
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x30006f82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
mov ecx, ebx
call fcn.30006dd8
test esi, esi
jle 0x30006f7d
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 4], esi
jmp 0x30006fbd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x30001828
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x30006f5d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x30006fb6
cmp dword [ebp - 0xc], 0
jbe 0x30006fb6
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx], eax
jmp 0x30007000
mov dword [ebp - 4], 0x80004005
cmp dword [ebp - 4], 0
jge 0x30007000
cmp dword [ebp - 4], 0x80070057
je 0x30007000
cmp dword [ebp + 0x10], 0
je 0x30006fe8
push dword [ebp + 0x10]
call fcn.30005c4a
test eax, eax
jle 0x30006fe8
mov eax, dword [ebp + 0x10]
mov ecx, 0x300012e8
jmp 0x30006ff0
mov ecx, dword [ebp + 8]
mov eax, 0x30001804
push ecx
push eax
push 0x300017a8
push ebx
call fcn.30006d4e
add esp, 0x10
cmp dword [ebp - 8], 0
pop edi
pop ebx
je 0x30007011
push dword [ebp - 8]
call fcn.3000d83e
pop ecx
mov eax, dword [ebp - 4]
pop esi
leave
ret 0xc
Function at 0x30007019
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x54], edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ebx, dword [ebp + 8]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x300070c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x300115a8
push eax
mov ecx, edi
call fcn.30006dd8
cmp ebx, esi
je 0x30007086
push ebx
call fcn.30005c4a
test eax, eax
jle 0x30007086
mov dword [ebp + 0xc], ebx
jmp 0x30007097
mov eax, dword [ebp + 0xc]
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0x30007097
mov dword [ebp + 0xc], 0x300012e8
cmp ebx, esi
je 0x300070aa
push ebx
call fcn.30005c4a
test eax, eax
mov eax, 0x300018a4
jg 0x300070af
mov eax, 0x30001884
push dword [ebp + 0xc]
push eax
push 0x30001830
push edi
call fcn.30006d4e
add esp, 0x10
mov eax, 0x80004005
jmp 0x300070e5
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x300070ec
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x14], esi
mov dword [ebp - 8], edi
je 0x300072ac
movzx eax, word [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x3000713d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push dword [ebp + 0x10]
push ebx
push 0x30001b28
jmp 0x30007193
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
jne 0x30007169
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push dword [ebp + 0x10]
push ebx
push 0x30001ac8
jmp 0x30007193
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0x30007196
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push dword [ebp + 0x10]
push ebx
push 0x30001a78
push esi
jmp 0x300071b4
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, esi
jne 0x300071be
push dword [ebp + 0x10]
push ebx
push 0x30001a08
push 0x300115a8
call fcn.30006d4e
add esp, 0x10
jmp 0x30007212
mov ebx, dword [ebp + 0x14]
push 1
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push ebx
call dword [sym.imp.MSO.dll_Ordinal_403]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
jne 0x3000721c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push ebx
call fcn.30005c4a
test eax, eax
jg 0x30007203
mov ebx, 0x300012e8
push ebx
push 0x300019c8
push esi
call fcn.30006d4e
add esp, 0xc
mov edi, 0x80004005
jmp 0x300072ab
push esi
lea ecx, [ebp - 4]
push ecx
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x30007268
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push ebx
call fcn.30005c4a
test eax, eax
jg 0x30007252
mov ebx, 0x300012e8
push ebx
push 0x3000198c
push esi
call fcn.30006d4e
add esp, 0xc
mov edi, 0x80004005
jmp 0x300072a2
cmp dword [ebp - 4], edi
je 0x3000729f
push ebx
call fcn.30005c4a
test eax, eax
jg 0x3000727c
mov ebx, 0x300012e8
push dword [ebp - 4]
push edi
push ebx
push 0x300018c0
push 0x300115a8
call fcn.30006d4e
add esp, 0x14
cmp dword [ebp - 4], edi
je 0x3000729f
mov dword [ebp - 8], 0x80004005
mov edi, dword [ebp - 8]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 0x10
Function at 0x300072b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], 0xfe
call dword [sym.imp.MSO.dll_Ordinal_3061]
test eax, eax
ja 0x300072e4
mov dword [ebp - 0xc], 0x80070057
jmp 0x30007404
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x30007403
push esi
push 1
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push ebx
call dword [sym.imp.MSO.dll_Ordinal_403]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x3000734e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push ebx
call fcn.30005c4a
test eax, eax
jg 0x30007333
mov ebx, 0x300012e8
push ebx
push 0x300019c8
push esi
call fcn.30006d4e
add esp, 0xc
mov dword [ebp - 0xc], 0x80004005
jmp 0x30007402
push dword [ebp + 0xc]
call dword [sym.imp.MSO.dll_Ordinal_3060]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x300073bc
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x300073bc
cmp dword [ebp - 8], ebx
je 0x300073f9
push dword [ebp + 8]
call fcn.30005c4a
test eax, eax
mov eax, dword [ebp + 8]
jg 0x3000739e
mov eax, 0x300012e8
push dword [ebp - 8]
push ebx
push eax
push 0x300018c0
push 0x300115a8
call fcn.30006d4e
add esp, 0x14
cmp dword [ebp - 8], ebx
je 0x300073f9
jmp 0x300073f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push dword [ebp + 8]
call fcn.30005c4a
test eax, eax
mov eax, dword [ebp + 8]
jg 0x300073e3
mov eax, 0x300012e8
push eax
push 0x3000198c
push esi
call fcn.30006d4e
add esp, 0xc
mov dword [ebp - 0xc], 0x80004005
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
pop edi
leave
ret 8

Function at 0x3000740c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x30007448
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x300115a8
push eax
mov ecx, esi
call fcn.30006dd8
push dword [ebp + 8]
push 0x30001b84
push esi
call fcn.30006d4e
add esp, 0xc
mov esi, 0x80004005
mov eax, esi
pop esi
pop ebp
ret 4