joyce8/EMBER2024-capa huggingface dataset:
Function at 0x300339d0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x20c
push esi
push edi
mov edi, ecx
lea esi, [edi + 0xc8]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [edi + 0x10]
call fcn.30030090
cmp eax, 0xffffffff
jne 0x30033a01
pop edi
xor al, al
pop esi
add esp, 0x20c
ret 8
mov cl, byte [esp + 0x218]
push ebx
xor edx, edx
mov ebx, 1
test bl, cl
push ebp
mov dword [esp + 0x118], edx
mov dword [esp + 0x14], edx
je 0x30033a2e
mov dword [esp + 0x11c], eax
mov dword [esp + 0x118], ebx
test cl, 2
je 0x30033a3b
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
push edx
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x124]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x30033a63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
jmp 0x30033a67
mov byte [esp + 0x13], bl
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call ebp
mov al, byte [esp + 0x224]
test al, al
mov eax, dword [edi + 8]
jne 0x30033aaa
cmp eax, 2
jne 0x30033aa4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x64
call ebx
push esi
call ebp
cmp dword [edi + 8], 2
je 0x30033a90
cmp dword [edi + 8], 3
jmp 0x30033aad
cmp eax, 2
je 0x30033ab4
mov byte [esp + 0x13], 0
mov al, byte [esp + 0x13]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20c
ret 8
Function at 0x300344a0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 8]
test eax, eax
jne 0x300344c1
pop edi
mov eax, 2
pop ebx
add esp, 0x14
ret 4
cmp eax, 3
jne 0x300344d0
pop edi
xor eax, eax
pop ebx
add esp, 0x14
ret 4
call fcn.30033ad0
test eax, eax
jne 0x300344e6
pop edi
mov eax, 1
pop ebx
add esp, 0x14
ret 4
lea eax, [edi + 0xc8]
push eax
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x30034507
lea eax, [edi + 0xb0]
jmp 0x30034516
push eax
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.30075610
push ebp
lea ebp, [edi + 0xbc]
push eax
mov ecx, ebp
call fcn.30075630
test bl, 1
je 0x30034537
mov eax, dword [esp + 0x14]
push eax
call fcn.30208320
add esp, 4
push esi
push 0x78
call fcn.3007a1f0
add esp, 4
test eax, eax
je 0x30034552
push ebp
mov ecx, eax
call fcn.30033b60
mov esi, eax
jmp 0x30034554
xor esi, esi
cmp byte [esi], 0
jne 0x30034583
mov ecx, esi
call fcn.30033c00
push esi
call fcn.30208320
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop edi
mov eax, 4
pop ebx
add esp, 0x14
ret 4
lea ecx, [edi + 0x10]
mov dword [edi + 8], 2
call fcn.30030090
cmp eax, 0xffffffff
je 0x300345b0
lea edx, [esp + 0x14]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push esi
push ebp
mov ecx, edi
call fcn.30034330
test al, al
jne 0x300345e7
mov ecx, esi
call fcn.30033c00
push esi
call fcn.30208320
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop edi
mov eax, 3
pop ebx
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x28]
push ecx
call fcn.30033760
add esp, 4
mov ebx, eax
push ebx
mov ecx, esi
call fcn.30033450
push ebx
mov ebp, eax
call fcn.30208320
add esp, 4
test ebp, ebp
mov ecx, esi
je 0x30034634
call fcn.30033c00
push esi
call fcn.30208320
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebp
pop ebp
pop edi
pop ebx
add esp, 0x14
ret 4
call fcn.300338f0
test al, al
jne 0x30034667
mov ecx, esi
call fcn.30033c00
push esi
call fcn.30208320
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop edi
mov eax, 4
pop ebx
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x10]
push ecx
mov dword [edi + 0xe0], esi
mov dword [edi + 8], 3
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x14
ret 4
Function at 0x30034b00
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
xor edi, edi
cmp eax, edi
mov dword [esi], 0x30296450
je 0x30034b18
call fcn.300346c0
lea eax, [esi + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [esi + 0xbc]
push ecx
call fcn.30208320
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov edx, dword [esi + 0xb0]
push edx
call fcn.30208320
add esp, 8
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
pop edi
lea ecx, [esi + 0x10]
pop esi
jmp fcn.30030490

Function at 0x30034c10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
xor edi, edi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x30034c88
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x30034c82
mov ecx, dword [esi]
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x30034c81
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x30034c50
sub eax, edx
inc eax
push eax
call fcn.3007a1f0
mov edi, eax
mov edx, edi
add esp, 4
mov eax, esi
sub edx, esi
jmp 0x30034c70
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x30034c70
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret
Function at 0x30034c90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push 0
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
mov eax, dword [ebx + 4]
je 0x30034e0a
push esi
push edi
push eax
call fcn.30208320
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 5
mov dword [ebx + 4], 0
jle 0x30034d92
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x30034cf3
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x30034d21
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push eax
call fcn.3011ec50
add esp, 8
jmp 0x30034d17
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x30034d21
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 0
push 6
push eax
call fcn.3011ed40
add esp, 0x10
push esi
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebx + 4]
test esi, esi
je 0x30034dff
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x30034d31
sub eax, edx
mov edi, eax
cmp byte [esi], 0
je 0x30034dff
lea ecx, [esp + 0x10]
push ecx
lea edx, [edi + esi]
push edx
push esi
call fcn.3011e530
add esp, 0xc
cmp word [esp + 0x10], 0xd
jne 0x30034d7c
cmp byte [esi], 0
mov eax, esi
je 0x30034d77
mov cl, byte [eax + 1]
test cl, cl
je 0x30034d77
mov byte [eax], cl
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x30034d66
mov byte [eax], 0
jmp 0x30034d7e
add esi, eax
cmp byte [esi], 0
jne 0x30034d45
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebx + 4]
pop edi
pop esi
pop ebx
ret 4
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x30034dca
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x30034da3
sub eax, edx
inc eax
push eax
call fcn.3007a1f0
add esp, 4
mov dword [ebx + 4], eax
mov ecx, esi
mov edx, eax
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x30034dc0
mov edx, dword [ebx + 4]
test edx, edx
je 0x30034dff
mov al, byte [edx]
test al, al
je 0x30034dff
cmp al, 0xd
jne 0x30034df8
cmp byte [edx], 0
mov eax, edx
je 0x30034df3
mov cl, byte [eax + 1]
test cl, cl
je 0x30034df3
mov byte [eax], cl
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x30034de2
mov byte [eax], 0
jmp 0x30034df9
inc edx
mov al, byte [edx]
test al, al
jne 0x30034dd7
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebx + 4]
pop edi
pop esi
pop ebx
ret 4
Function at 0x30034e10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x30034f7c
cmp byte [esi], 0
je 0x30034f7c
mov eax, dword [esp + 0xc]
push ebx
push ebp
push edi
xor ebx, ebx
xor edi, edi
cmp eax, 5
jle 0x30034f03
push esi
call fcn.3011e7c0
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x30034f79
push ebp
call fcn.3005ca90
mov esi, eax
add esp, 4
lea eax, [esi + esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x30034e8e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push eax
call fcn.3011ea00
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ebp, [esi + esi*2 + 1]
push ebp
call fcn.3007a1f0
mov edi, eax
add esp, 4
test edi, edi
je 0x30034ef0
mov ecx, dword [esp + 0x14]
push 0
push 0
push ebp
push edi
push esi
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push 0x2002
mov byte [eax + edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x30034ee7
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x30034ed6
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call fcn.30208320
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.30208320
mov edi, dword [esp + 0x1c]
add esp, 4
jmp 0x30034f41
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x30034f08
sub eax, edx
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x30034f79
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x30034f30
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x30034f30
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jne 0x30034f49
test edi, edi
je 0x30034f79
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x30034f79
call dword [sym.imp.USER32.dll_EmptyClipboard]
test edi, edi
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
je 0x30034f6a
push edi
push 0xd
call esi
test ebx, ebx
je 0x30034f73
push ebx
push 1
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
pop esi
ret 8

Function at 0x30034f80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
xor esi, esi
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x30034fbd
push edi
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call edi
test eax, eax
jne 0x30034fb1
push 0xd
call edi
test eax, eax
jne 0x30034fb1
mov eax, dword [ebx]
push eax
call edi
test eax, eax
je 0x30034fb6
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x30074d60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
cmp byte [eax], 0
je 0x30074d87
jmp 0x30074d70
mov cl, byte [eax]
movzx edx, cl
mov dl, byte [edx + 0x302993c8]
xor dl, cl
mov byte [eax], dl
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x30074d70
ret
Function at 0x3007b8f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
sub esp, 0xa0
cmp edx, 0x40
push ebx
push ebp
push esi
push edi
jbe 0x3007b92a
mov ecx, dword [esp + 0xbc]
lea eax, [esp + 0x90]
push eax
push edx
push ecx
call fcn.300cbe20
add esp, 0xc
lea ebx, [esp + 0x90]
mov edx, 0x20
jmp 0x3007b931
mov ebx, dword [esp + 0xbc]
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov ecx, edx
mov eax, ecx
shr ecx, 2
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
shr ecx, 2
mov esi, ebx
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0x10]
mov bl, byte [esp + eax + 0x50]
xor cl, 0x36
xor bl, 0x5c
mov byte [esp + eax + 0x10], cl
mov byte [esp + eax + 0x50], bl
inc eax
cmp eax, 0x40
jl 0x3007b975
mov ebp, dword [esp + 0xb8]
add ebp, 0x40
push ebp
call fcn.3007a1f0
mov ebx, eax
mov ecx, 0x10
lea esi, [esp + 0x14]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xbc]
mov esi, dword [esp + 0xb8]
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc8]
push ecx
push ebp
push ebx
call fcn.300cbe20
push ebx
call fcn.30208320
push 0x60
call fcn.3007a1f0
mov ebx, eax
mov eax, dword [esp + 0xdc]
push eax
mov ecx, 0x10
lea esi, [esp + 0x6c]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, eax
push 0x60
lea edi, [ebx + 0x40]
mov ecx, 8
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.300cbe20
push ebx
call fcn.30208320
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x3009ea10
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov eax, ecx
mov ecx, dword [esp + 0xc]
push ebx
mov dword [eax + 4], ecx
xor ecx, ecx
mov dword [eax + 0xc], edx
mov edx, dword [esp + 8]
push esi
mov dword [eax], 0x3029a658
mov dword [eax + 8], ecx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
xor ebx, ebx
lea esi, [eax + 0x43c]
mov edx, ebx
shr edx, 1
test bl, 1
je 0x3009ea51
xor edx, 0xedb88320
test dl, 1
je 0x3009ea60
shr edx, 1
xor edx, 0xedb88320
jmp 0x3009ea62
shr edx, 1
test dl, 1
je 0x3009ea71
shr edx, 1
xor edx, 0xedb88320
jmp 0x3009ea73
shr edx, 1
test dl, 1
je 0x3009ea82
shr edx, 1
xor edx, 0xedb88320
jmp 0x3009ea84
shr edx, 1
test dl, 1
je 0x3009ea93
shr edx, 1
xor edx, 0xedb88320
jmp 0x3009ea95
shr edx, 1
test dl, 1
je 0x3009eaa4
shr edx, 1
xor edx, 0xedb88320
jmp 0x3009eaa6
shr edx, 1
test dl, 1
je 0x3009eab5
shr edx, 1
xor edx, 0xedb88320
jmp 0x3009eab7
shr edx, 1
test dl, 1
je 0x3009eac6
shr edx, 1
xor edx, 0xedb88320
jmp 0x3009eac8
shr edx, 1
mov dword [esi], edx
inc ebx
add esi, 4
cmp ebx, 0x100
jb 0x3009ea42
pop esi
mov byte [eax + 0x93b], cl
pop ebx
ret 0xc

Function at 0x3009eb40
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [ecx + 0x10]
test edx, edx
push ebx
push ebp
push esi
push edi
je 0x3009ec31
mov edi, dword [ecx + 8]
mov ebp, dword [ecx + 0xc]
lea esi, [edi + 4]
cmp esi, ebp
jae 0x3009ec31
xor eax, eax
mov dword [ecx + 8], esi
mov ah, byte [edi + edx]
movzx ebx, byte [edi + edx + 2]
mov al, byte [edi + edx + 1]
movzx edi, byte [edi + edx + 3]
shl eax, 8
or eax, ebx
shl eax, 8
or edi, eax
lea eax, [esi + 4]
cmp eax, ebp
jae 0x3009ec31
xor ebx, ebx
mov dword [ecx + 8], eax
mov bh, byte [esi + edx]
movzx eax, byte [esi + edx + 2]
mov bl, byte [esi + edx + 1]
movzx edx, byte [esi + edx + 3]
shl ebx, 8
or ebx, eax
mov eax, dword [esp + 0x18]
shl ebx, 8
or ebx, edx
mov dword [eax], ebx
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
lea edx, [eax + edi + 4]
cmp edx, esi
mov dword [esp + 0x10], ebx
jae 0x3009ec31
mov esi, 0xfffffffc
or edx, 0xffffffff
cmp edi, esi
jle 0x3009ebf6
mov ebx, dword [ecx + 0x10]
lea ebp, [eax + ebx]
xor ebx, ebx
mov bl, byte [esi + ebp]
xor ebx, edx
and ebx, 0xff
shr edx, 8
xor edx, dword [ecx + ebx*4 + 0x43c]
inc esi
cmp esi, edi
jl 0x3009ebd6
mov ebx, dword [esp + 0x10]
mov ebp, dword [ecx + 0x10]
lea esi, [eax + edi]
movzx ecx, byte [esi + ebp + 2]
xor eax, eax
mov ah, byte [esi + ebp]
add esi, ebp
not edx
mov al, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 3]
shl eax, 8
or eax, ecx
cmp edx, eax
jne 0x3009ec31
cmp ebx, 0x49454e44
je 0x3009ec31
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
Function at 0x300a0ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x84]
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
lea ebx, [ebx]
mov eax, esi
imul eax, ecx
lea eax, [eax + eax*2]
cmp eax, 0x800000
jae 0x300a0cef
cmp ecx, 0xb40
jg 0x300a0cef
cmp esi, 0xb40
jle 0x300a0d03
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
jmp 0x300a0cd0
cmp ecx, 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ecx
jl 0x300a0e02
cmp esi, 1
jl 0x300a0e02
mov esi, dword [esp + 0x6c]
mov ecx, esi
mov dword [esi + 0x250], 1
call fcn.300f6000
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov eax, dword [esi]
xor ebp, ebp
push ebp
push 6
push ecx
push edx
mov ecx, esi
call dword [eax + 0x3c]
push eax
lea ecx, [esp + 0x34]
call fcn.300041a0
cmp dword [esp + 0x30], ebp
je 0x300a0df9
lea ecx, [esp + 0x20]
lea edi, [esi + 0x144]
push ecx
mov ecx, edi
call fcn.300bcfe0
mov eax, dword [esp + 0x78]
mov ebx, dword [esp + 0x70]
mov ecx, dword [ebx + 0x54]
push 2
lea edx, [esp + 0x14]
push edx
push eax
push ecx
mov ecx, edi
call fcn.300bdda0
mov dword [esi + 0x23c], ebp
mov dword [esi + 0x240], ebp
mov edx, dword [ebx + 0x54]
mov ecx, edi
mov dword [esi + 0x254], edx
call fcn.300bd0e0
mov eax, dword [esi + 0x574]
push eax
mov ecx, edi
mov dword [esi + 0x254], ebp
call fcn.300bcfe0
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x80]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x94]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x98]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x88]
call fcn.30031730
mov dword [esi + 0x250], ebp
lea ecx, [esp + 0x20]
call fcn.30003ec0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x300ac770
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x30336628]
test al, al
je 0x300ac7a8
mov edx, dword [esp + 4]
mov ecx, dword [edx + 0x4c]
mov eax, dword [ecx]
cmp eax, 0x13
mov dword [esp + 4], edx
jne 0x300ac790
jmp fcn.300ab9c0
cmp eax, 0x12
jne 0x300ac7a3
test byte [ecx + 0x94], 0xc
jne 0x300ac78b
jmp fcn.300ac230
jmp fcn.300ab440
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 0x4c]
mov eax, dword [edx]
cmp eax, 0x13
mov dword [esp + 4], ecx
jne 0x300ac7bf
jmp fcn.300abd70
cmp eax, 0x12
jne 0x300ac7c9
jmp fcn.300ac390
jmp fcn.300ab690
Function at 0x300b4860
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov dword [eax], ecx
shr ecx, 2
and ebx, 3
test ecx, ecx
push esi
jbe 0x300b48a2
push edi
mov edi, ecx
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
mov dword [eax], esi
shl ecx, 0x10
xor ecx, esi
add edx, 2
mov dword [eax], ecx
movzx esi, word [edx]
shl esi, 0xb
xor esi, ecx
mov dword [eax], esi
mov ecx, esi
shr esi, 0xb
add esi, ecx
add edx, 2
dec edi
mov dword [eax], esi
jne 0x300b4873
pop edi
mov ecx, ebx
dec ecx
je 0x300b48e6
dec ecx
je 0x300b48d1
dec ecx
jne 0x300b48fc
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
shl ecx, 0x10
xor ecx, esi
mov dword [eax], ecx
movzx edx, byte [edx + 2]
shl edx, 0x12
xor edx, ecx
mov ecx, edx
shr ecx, 0xb
add ecx, edx
mov dword [eax], ecx
jmp 0x300b48fc
movzx edx, word [edx]
mov ecx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xb
xor ecx, edx
mov edx, ecx
shr edx, 0x11
jmp 0x300b48f8
movzx ecx, byte [edx]
mov edx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xa
xor ecx, edx
mov edx, ecx
shr edx, 1
add edx, ecx
mov dword [eax], edx
mov edx, dword [eax]
lea ecx, [edx*8]
xor ecx, edx
mov edx, ecx
shr edx, 5
add edx, ecx
lea ecx, [edx*4]
xor ecx, edx
mov edx, ecx
shr edx, 0xf
add ecx, edx
mov edx, ecx
shl edx, 0xa
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
ret
Function at 0x300c9fd0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x300cbe20
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x70
mov ecx, dword [esp + 0x74]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x78]
push eax
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x6a09e667
mov dword [esp + 0x10], 0xbb67ae85
mov dword [esp + 0x14], 0x3c6ef372
mov dword [esp + 0x18], 0xa54ff53a
mov dword [esp + 0x1c], 0x510e527f
mov dword [esp + 0x20], 0x9b05688c
mov dword [esp + 0x24], 0x1f83d9ab
mov dword [esp + 0x28], 0x5be0cd19
mov dword [esp + 0x78], 0x20
call fcn.300cb940
mov ecx, dword [esp + 0x88]
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.300cbbf0
add esp, 0x84
ret
Function at 0x300d4260
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push 0x50
mov ebx, ecx
call fcn.3007a1f0
mov esi, eax
add esp, 4
test esi, esi
je 0x300d42b6
mov ecx, ebx
call fcn.300850a0
test eax, eax
je 0x300d428f
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x24]
mov cl, byte [eax + 0x139]
test cl, cl
jne 0x300d42a5
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 8]
cmp eax, dword [ecx + 0x3ec]
jne 0x300d42a5
mov eax, dword [ecx + 0x3e8]
jmp 0x300d42a8
add eax, 0x10
push eax
mov ecx, esi
call fcn.300a3df0
mov esi, eax
test esi, esi
jne 0x300d42bd
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, dword [ebx + 0x50]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x20], ecx
mov dword [ebx + 0x50], esi
push ebp
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp]
mov dword [esi + 0x24], edx
movzx cx, byte [eax + 3]
mov word [esi + 0xe], cx
movzx dx, byte [eax]
mov word [esi + 0xc], dx
movzx cx, byte [eax + 1]
mov word [esi + 0xa], cx
movzx dx, byte [eax + 2]
mov eax, dword [esp + 0x14]
test eax, eax
push edi
lea edi, [esi + 8]
mov word [edi], dx
je 0x300d4313
lea ecx, [eax + 0x1c]
cmp dword [ecx], 0
je 0x300d4313
push 1
push edi
call fcn.300ad0a0
movzx eax, word [edi + 6]
cmp eax, 0xff
jge 0x300d434e
movzx ecx, word [edi + 4]
movzx edx, word [edi + 2]
inc eax
imul ecx, eax
imul edx, eax
sar ecx, 8
mov word [edi + 4], cx
movzx ecx, word [edi]
imul ecx, eax
sar edx, 8
sar ecx, 8
mov word [edi + 2], dx
mov word [edi], cx
mov eax, 1
jmp 0x300d4350
xor eax, eax
mov ecx, ebx
mov byte [esi + 0x2c], al
call fcn.300850a0
test eax, eax
je 0x300d4373
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x24]
mov cl, byte [eax + 0x139]
test cl, cl
je 0x300d4373
add eax, 0x10
jmp 0x300d438c
mov ebx, dword [ebx + 0x2c]
mov eax, dword [ebx + 8]
cmp ebx, dword [eax + 0x3ec]
jne 0x300d4389
mov eax, dword [eax + 0x3e8]
jmp 0x300d438c
lea eax, [ebx + 0x10]
mov ecx, dword [eax + 0x80]
test ecx, ecx
je 0x300d439d
mov ecx, esi
call fcn.300b1a10
mov eax, dword [ebp]
inc eax
pop edi
mov dword [ebp], eax
pop ebp
mov eax, esi
pop esi
pop ebx
ret 0xc