joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3001c5a9
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push 0x3000b184
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x3001c5d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x3001c5d2
xor edi, edi
jmp 0x3001c5e0
xor edi, edi
inc edi
test esi, esi
je 0x3001c5e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x3001c5e5
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x30034be8]
push esi
push edi
mov dword [ebp - 4], eax
mov edi, 0xc8
push edi
lea eax, [ebp - 0x194]
push eax
call fcn.3001510b
push eax
push 0x3000b2d4
call fcn.3000ff32
pop ecx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3000b184
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x3001c655
push 0x3000b288
call fcn.3000fe20
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x3001c617
test esi, esi
je 0x3001c66c
push 0x3000b254
call fcn.3000fe20
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
lea eax, [ebp - 0x194]
push eax
call fcn.3001510b
push eax
push 0x3000b21c
call fcn.3000ff32
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.3001f57d
leave
ret
Function at 0x3001cbdf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x30034be8]
push esi
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x61c]
push eax
push 0x3000ba60
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.3000d759
add esp, 0x10
push 0x3000ba18
mov dword [0x30076cfc], eax
call fcn.3000fe20
lea eax, [ebp - 0x210]
push eax
call fcn.3000fe20
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x3001cc67
push 0x3000b9fc
call fcn.3000fe20
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
jmp 0x3001ccbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x485
je 0x3001cc95
cmp eax, 0x7e
je 0x3001cc95
push eax
push 0x3000b9cc
lea eax, [ebp - 0x410]
push 0xff
push eax
call fcn.3000d759
add esp, 0x10
jmp 0x3001ccab
push 0x3000b978
push 0xff
lea eax, [ebp - 0x410]
push eax
call fcn.3000cd1d
mov dword [0x30076cfc], eax
lea eax, [ebp - 0x410]
push eax
call fcn.3000fe20
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.3001f57d
leave
ret

Function at 0x3001d32f
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov eax, 0x1000c
lea ebp, [esp - 0xff8c]
call fcn.3001f58a
mov eax, dword [0x30034be8]
push esi
push edi
xor edi, edi
mov dword [ebp + 0xff88], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], edi
call fcn.3001d26f
mov esi, eax
cmp esi, edi
jl 0x3001d41e
push ebx
lea eax, [ebp - 0x7c]
push eax
push edi
push edi
push dword [ebp + 0xff98]
push dword [0x3007bd68]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x80070000
jmp 0x3001d3d6
push 0
lea eax, [ebp - 0x80]
push eax
push 0x10000
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0xff94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x3001d3be
call edi
mov esi, eax
test esi, esi
jle 0x3001d3bc
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001d41d
xor esi, esi
cmp dword [ebp - 0x80], esi
jbe 0x3001d3f0
push esi
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x3001d38b
call edi
mov esi, eax
test esi, esi
jle 0x3001d3ec
and esi, 0xffff
or esi, ebx
test esi, esi
jge 0x3001d38b
jmp 0x3001d41d
push 0
push dword [ebp + 0xffa0]
push dword [ebp + 0xff9c]
push 2
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x3001d41d
call edi
mov esi, eax
test esi, esi
jle 0x3001d41d
and esi, 0xffff
or esi, ebx
pop ebx
cmp dword [ebp - 0x7c], 0
je 0x3001d42d
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp + 0xff88]
pop edi
mov eax, esi
pop esi
call fcn.3001f57d
add ebp, 0xff8c
leave
ret 0x10
Function at 0x3001dc35
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ebx, 0x80070000
jne 0x3001dc7f
call edi
mov esi, eax
test esi, esi
jle 0x3001dc79
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001dd0e
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x3001dc98
mov esi, 0x8007000e
jmp 0x3001dcff
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x3001dcbf
call edi
mov esi, eax
test esi, esi
jle 0x3001dcbd
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001dcff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x30001920
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x3001dcec
call edi
mov esi, eax
test esi, esi
jle 0x3001dcea
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001dcff
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x3001dd0e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3001ddc7
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 0x44
pop edi
push 1
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0xff
call fcn.3001f1eb
test eax, eax
mov dword [ebp - 4], eax
mov ebx, 0x80070000
jne 0x3001de11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x3001de0b
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001defe
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.3001d4ae
mov esi, eax
test esi, esi
jl 0x3001defe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x3001def1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x3001dee0
cmp dword [ebp - 0x10], edi
jbe 0x3001de8d
push 1
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.3001f20b
mov edi, eax
test edi, edi
jne 0x3001de8a
call esi
mov esi, eax
test esi, esi
jle 0x3001de88
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001defe
mov dword [ebp - 4], edi
cmp dword [ebp - 0xc], 0xff
jbe 0x3001dea8
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.3001d4ae
mov esi, eax
test esi, esi
jl 0x3001defe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x3001def1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x3001deef
and esi, 0xffff
or esi, ebx
jmp 0x3001deed
test eax, eax
jle 0x3001deeb
and eax, 0xffff
or eax, ebx
mov esi, eax
test esi, esi
jl 0x3001defe
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], ecx
mov dword [ebp - 4], esi
cmp dword [ebp - 8], 0
je 0x3001df0c
push dword [ebp - 8]
call fcn.3001f22f
cmp dword [ebp - 4], 0
je 0x3001df1a
push dword [ebp - 4]
call fcn.3001f22f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3001e2a7
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
mov eax, dword [0x30034be8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
imul ecx, ecx, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
push edi
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0xd8]
push eax
xor ebx, ebx
push 0x69
mov dword [ebp - 0x2e4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x3001e30f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x3001e309
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x3001e3f2
lea edi, [ebp - 0xd8]
add esi, 0x14
cmp word [edi], 0
je 0x3001e3dd
mov eax, dword [ebp + 0xc]
cmp ebx, dword [eax]
je 0x3001e401
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x3001e3d4
lea eax, [ebp - 0x2e4]
push eax
push edi
call fcn.3001e1e2
test eax, eax
jl 0x3001e3f2
cmp dword [ebp - 0x2e4], 0
jne 0x3001e3d4
lea eax, [esi - 0xc]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2fc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x3001e3d4
mov ax, word [edi]
cmp ax, 0x61
jb 0x3001e38f
cmp ax, 0x7a
ja 0x3001e38f
movzx eax, ax
sub eax, 0x60
jmp 0x3001e3a1
cmp ax, 0x41
jb 0x3001e3d4
cmp ax, 0x5a
ja 0x3001e3d4
movzx eax, ax
sub eax, 0x40
push 0xa
push esi
mov dword [esi - 0x14], eax
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0x104
lea eax, [ebp - 0x2e0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x3001e3d4
inc ebx
add esi, 0x28
add edi, 8
jne 0x3001e318
mov eax, dword [ebp + 0xc]
push 0x3001e270
push 0x28
push ebx
push dword [ebp + 8]
mov dword [eax], ebx
call fcn.3001d5bf
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 8
mov eax, 0x8007007a
jmp 0x3001e3f2
Function at 0x3001e408
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [edi], 0x5c
mov esi, dword [ebp + 0x10]
mov ebx, eax
jne 0x3001e4b1
cmp word [edi + 2], 0x5c
jne 0x3001e44f
push ebx
push edi
push esi
call fcn.3001da0d
test eax, eax
jl 0x3001e5f1
mov dword [ebp - 4], 1
jmp 0x3001e56b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add ebx, 3
cmp ebx, eax
mov dword [ebp + 0xc], eax
jbe 0x3001e466
mov dword [ebp + 0xc], ebx
push dword [ebp + 0xc]
push esi
call fcn.3001d4ae
test eax, eax
jl 0x3001e5f1
push dword [esi]
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x3001e4a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x3001e49d
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x3001e5f1
mov eax, dword [esi]
add ebx, 0xfffffffe
push edi
add eax, 4
jmp 0x3001e546
cmp word [edi + 2], 0x3a
je 0x3001e557
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x3001e4d0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
jmp 0x3001e4db
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
lea eax, [edi + ebx + 2]
push eax
push esi
call fcn.3001d4ae
test eax, eax
jl 0x3001e5f1
cmp dword [ebp + 0xc], 0
je 0x3001e505
push dword [ebp + 0xc]
lea eax, [edi + ebx + 2]
push eax
push dword [esi]
call fcn.3000ce3d
jmp 0x3001e529
push dword [esi]
lea eax, [edi + 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x3001e531
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x3001e52b
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x3001e5f1
mov ecx, dword [esi]
push dword [ebp + 8]
lea eax, [edi + edi]
mov word [eax + ecx], 0x5c
mov ecx, dword [esi]
inc ebx
lea eax, [eax + ecx + 2]
push ebx
push eax
call fcn.3000ce3d
test eax, eax
jl 0x3001e5f1
jmp 0x3001e56b
cmp word [edi + 4], 0x5c
jne 0x3001e568
push ebx
push edi
push esi
call fcn.3001da0d
jmp 0x3001e54d
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
inc ecx
inc ecx
cmp word [ecx], 0
mov edx, ecx
je 0x3001e5ed
cmp word [edx], 0x5c
jne 0x3001e5dd
lea edi, [edx + 2]
mov bx, word [edi]
cmp bx, 0x5c
mov dword [ebp + 0xc], ebx
je 0x3001e5e5
cmp bx, 0x2e
jne 0x3001e5a1
mov bx, word [edx + 4]
cmp bx, 0x5c
je 0x3001e5d9
test bx, bx
je 0x3001e5d9
cmp word [ebp + 0xc], 0x2e
jne 0x3001e5dd
lea edi, [edx + 4]
cmp word [edi], 0x2e
jne 0x3001e5dd
cmp word [edx + 6], 0x5c
jne 0x3001e5dd
mov edx, dword [ebp - 4]
mov ebx, dword [esi]
neg edx
sbb edx, edx
add edx, 3
lea edx, [ebx + edx*2]
cmp ecx, edx
jbe 0x3001e5d9
jmp 0x3001e5d3
cmp word [ecx], 0x5c
je 0x3001e5d9
dec ecx
dec ecx
cmp ecx, edx
ja 0x3001e5cd
mov edx, edi
jmp 0x3001e5e5
mov di, word [edx]
mov word [ecx], di
inc ecx
inc ecx
inc edx
inc edx
cmp word [edx], 0
jne 0x3001e577
and word [ecx], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3001e8af
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
or eax, 0xffffffff
cmp dword [0x3007c170], ecx
push edi
mov esi, 0xff
jne 0x3001e8f2
mov dword [0x3007c170], 1
push 8
mov edx, ecx
pop edi
test dl, 1
je 0x3001e8e1
shr edx, 1
xor edx, 0xedb88320
jmp 0x3001e8e3
shr edx, 1
dec edi
jne 0x3001e8d2
mov dword [ecx*4 + 0x3007bd70], edx
inc ecx
cmp ecx, esi
jle 0x3001e8cd
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x3001e912
mov edi, dword [esp + 0xc]
mov dl, byte [edi]
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x3007bd70]
inc edi
dec ecx
jne 0x3001e8fe
pop edi
not eax
pop esi
ret 8
Function at 0x3001f269
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x3000bd60
call fcn.3001f687
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x3001f2a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x3001f2a9
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x3001f2c1
cmp eax, 0x20b
je 0x3001f2ae
mov dword [ebp - 0x1c], ebx
jmp 0x3001f2d5
cmp dword [ecx + 0x84], 0xe
jbe 0x3001f2a9
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x3001f2cf
cmp dword [ecx + 0x74], 0xe
jbe 0x3001f2a9
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x3007c1b4], 0xffffffff
or dword [0x3007c1b8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x3007c180]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x3007c17c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x3007c1b0], eax
call fcn.3001f5ff
call fcn.3001f1ea
cmp dword [0x30034bec], ebx
jne 0x3001f335
push fcn.3001f1e7
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.3001f6e5
push 0x30024104
push 0x30024100
call sub.MSVCRT.dll__initterm
push 0x3001f643
call fcn.3001f5ed
mov eax, dword [0x3007c178]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x3007c174]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x3001f389
push 8
call sub.MSVCRT.dll__amsg_exit
pop ecx
push 0x300240fc
push 0x300240f0
call sub.MSVCRT.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x3001f407
cmp al, bl
je 0x3001f3b3
cmp dword [ebp - 0x20], ebx
jne 0x3001f407
mov al, byte [esi]
cmp al, bl
je 0x3001f3c3
cmp al, 0x20
ja 0x3001f3c3
inc esi
mov dword [ebp - 0x24], esi
jmp 0x3001f3b3
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x3001f3df
movzx eax, word [ebp - 0x54]
jmp 0x3001f3e2
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.3001539f
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x3001f3ff
push esi
call dword [sym.imp.MSVCRT.dll_exit]
call dword [sym.imp.MSVCRT.dll__cexit]
jmp 0x3001f45c
cmp al, 0x22
jne 0x3001f416
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCRT.dll__ismbblead]
pop ecx
test eax, eax
je 0x3001f429
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x3001f3a1
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.3001f6c2
ret
Function at 0x3001f57d
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x30034be8]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.3001f57d
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [0x30034be8]
jne 0x3001f468
ret

Function at 0x30020852
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ebx, [esi + 4]
push ebx
push 0x3000c014
call edi
test eax, eax
jne 0x30020970
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [esi + 0x20c]
push ebx
call edi
mov esi, eax
add esi, 3
cmp dword [ebp + 0xc], 0
je 0x3002089e
push dword [ebp + 0xc]
call edi
lea esi, [esi + eax + 1]
push esi
lea eax, [ebp - 4]
push eax
call fcn.3001d4ae
mov edi, eax
test edi, edi
jl 0x30020994
push ebx
push 0x300016a0
push esi
push dword [ebp - 4]
call fcn.3000d759
mov edi, eax
add esp, 0x10
test edi, edi
jl 0x30020994
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x30020914
cmp esi, 0x7fffffff
jbe 0x300208e4
mov eax, 0x80070057
jmp 0x300208f2
push 0x30003ba8
push esi
push dword [ebp - 4]
call fcn.3000ce53
cmp eax, ebx
mov edi, eax
jl 0x30020994
push dword [ebp + 0xc]
push esi
push dword [ebp - 4]
call fcn.3000cf4d
mov edi, eax
test edi, edi
jl 0x30020994
xor ebx, ebx
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], 0x44
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x30020956
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor edi, edi
jmp 0x30020994
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
jle 0x30020994
and edi, 0xffff
or edi, 0x80070000
jmp 0x30020994
push ebx
push 0x3000c00c
call edi
test eax, eax
jne 0x3002098f
push dword [ebp + 0xc]
add esi, 0x20c
push esi
call fcn.30021b99
mov edi, eax
jmp 0x30020994
mov edi, 0x81000004
cmp dword [ebp - 4], 0
je 0x300209a2
push dword [ebp - 4]
call fcn.3001f22f
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x30021a03
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x30021a4f
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x30021a48
jbe 0x30021a71
cmp eax, 3
jbe 0x30021a38
cmp eax, 4
je 0x30021a48
jbe 0x30021a71
cmp eax, 6
ja 0x30021a43
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30021a0c
cmp eax, 7
jne 0x30021a71
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x30021a71
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x30021a61
call esi
mov esi, eax
jmp 0x30021a71
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
leave
ret 8

Function at 0x30021a78
Capabilities:
Start service

Disassembly:
push ecx
push ecx
xor eax, eax
cmp dword [esp + 0x10], eax
push ebx
setne al
push ebp
push esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
call fcn.30021a03
mov esi, eax
test esi, esi
mov ebp, 0xffff
mov ebx, 0x80070000
jle 0x30021aae
and esi, ebp
or esi, ebx
test esi, esi
jl 0x30021aef
cmp dword [esp + 0xc], 1
je 0x30021abe
cmp dword [esp + 0xc], 7
jne 0x30021aef
push edi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
xor edi, edi
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x30021aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub eax, 0x3e5
je 0x30021af9
sub eax, 0x3b
jne 0x30021afc
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8
xor edi, edi
inc edi
test esi, esi
jle 0x30021b04
and esi, ebp
or esi, ebx
test edi, edi
jne 0x30021abf
jmp 0x30021aee

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219