joyce8/EMBER2024-capa huggingface dataset:
Function at 0x300128ae
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 4], 0x101
call dword [sym.imp.ADVAPI32.DLL_GetUserNameA]
test eax, eax
jne 0x300128fc
mov edi, 0x30001880
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x434]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
test eax, eax
jne 0x30012943
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
mov edi, 0x30001890
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov esi, dword [sym.imp.USER32.DLL_wsprintfA]
push 0x30001668
push 0x300246c8
lea eax, [ebp - 0x330]
push 0x3001287a
push eax
call esi
add esp, 0x10
mov edi, 0x208
lea eax, [ebp - 0x22c]
push edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.3000e8e5
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x22c]
push 0x30012882
push eax
call fcn.3001f3a8
lea eax, [ebp + eax - 0x22c]
push eax
call esi
mov eax, dword [0x30024bf8]
add esp, 0x10
mov eax, dword [eax]
test eax, eax
je 0x300129c0
push eax
push 0x3001288a
jmp 0x300129cb
push dword [0x300249d4]
push 0x30012892
lea eax, [ebp - 0x22c]
push eax
call fcn.3001f3a8
lea eax, [ebp + eax - 0x22c]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.3000dbd8
push 0x300249d8
call fcn.3000e1ec
mov ebx, eax
cmp byte [ebx], 0x5c
jne 0x30012a09
inc ebx
push 0x30001680
push 0x300247cc
lea eax, [ebp - 0x330]
push 0x3001289a
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x22c]
push edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.3000e8e5
lea eax, [ebp - 0x434]
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x22c]
push 0x300128a2
push eax
call fcn.3001f3a8
lea eax, [ebp + eax - 0x22c]
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.3000dbd8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x300168e2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, eax
dec eax
test edi, edi
jle 0x30016922
lea edi, [eax + 1]
movzx eax, byte [ecx]
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or eax, ebx
inc ecx
xor edx, eax
dec edi
jne 0x30016900
and esi, 3
xor eax, eax
dec esi
je 0x3001693e
dec esi
je 0x30016937
dec esi
jne 0x30016943
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
pop esi
xor eax, edx
pop ebx
ret 0xc

Function at 0x300172fe
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edx, 0x8000
mov ecx, dword [eax + 0x14]
and dword [eax + 0x20], 0
push 2
mov word [eax + 0x3c], dx
mov dword [eax + 0x34], edx
add ecx, edx
pop edx
movzx esi, byte [ecx]
mov edi, dword [eax + 0x20]
and esi, 0x7fff
and edi, 0x3ff
shl edi, 5
xor esi, edi
inc ecx
dec edx
mov dword [eax + 0x20], esi
jne 0x3001731c
pop edi
pop esi
ret 4
Function at 0x3001b3e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x68]
push edi
mov edi, dword [esi + 0x70]
lea ecx, [edi + ebx]
cmp ecx, eax
ja 0x3001b43b
push 0
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
je 0x3001b43b
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x3001b43b
cmp dword [ebp + 0xc], ebx
jne 0x3001b43b
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x3001b433
mov dword [eax], edi
add dword [esi + 0x70], ebx
xor eax, eax
inc eax
jmp 0x3001b43d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x3001b444
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x4c]
mov edx, dword [esi + 0x48]
add edx, dword [esi + 0x44]
mov eax, dword [esi + 0x58]
mov dword [ebp - 8], ecx
add ecx, 0x10
cmp ecx, edx
push edi
mov dword [ebp - 4], eax
ja 0x3001b509
mov ecx, dword [esi + 0x54]
mov ebx, dword [ebp + 0x1c]
add ecx, dword [esi + 0x50]
lea edx, [ebx + eax]
cmp edx, ecx
ja 0x3001b509
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
push 0
push eax
push dword [ebp + 8]
call edi
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x3001b509
cmp dword [ebp + 0xc], ebx
jne 0x3001b509
mov eax, dword [ebp + 0x14]
push 0
push 0
push dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
call edi
test eax, eax
je 0x3001b509
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x3001b509
cmp dword [ebp + 0xc], 0x10
jne 0x3001b509
mov eax, dword [ebp + 0x20]
add dword [esi + 0x4c], 0x10
add dword [esi + 0x58], ebx
test eax, eax
je 0x3001b504
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x3001b50b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x3001b56f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x2c]
add eax, dword [esi + 0x28]
push edi
mov edi, dword [esi + 0x30]
lea ecx, [edi + ebx]
cmp ecx, eax
ja 0x3001b5ca
push 0
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
je 0x3001b5ca
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x3001b5ca
cmp dword [ebp + 0xc], ebx
jne 0x3001b5ca
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x3001b5c2
mov dword [eax], edi
add dword [esi + 0x30], ebx
xor eax, eax
inc eax
jmp 0x3001b5cc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x3001b5d3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.3001d35e
mov esi, dword [ebp + 0xc]
mov ebx, dword [esi + 0x64]
shl eax, 1
mov dword [ebp - 4], eax
add eax, 6
pop ecx
mov ecx, dword [esi + 0x60]
add ecx, dword [esi + 0x5c]
mov dword [ebp - 0xc], eax
add eax, ebx
cmp eax, ecx
ja 0x3001b669
xor edi, edi
push edi
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
je 0x3001b669
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x3001b669
cmp dword [ebp - 8], 4
jne 0x3001b669
add dword [ebp - 4], 2
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
test eax, eax
je 0x3001b669
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x3001b669
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x3001b65e
mov dword [eax], ebx
mov eax, dword [ebp - 0xc]
add dword [esi + 0x64], eax
xor eax, eax
inc eax
jmp 0x3001b66b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x3001b672
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
add eax, dword [esi + 0x38]
push edi
mov edi, dword [esi + 0x40]
lea ecx, [edi + 0x6c]
cmp ecx, eax
ja 0x3001b6cc
push 0
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
je 0x3001b6cc
push 0
lea eax, [ebp + 0xc]
push eax
push 0x6c
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x3001b6cc
cmp dword [ebp + 0xc], 0x6c
jne 0x3001b6cc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x3001b6c3
mov dword [eax], edi
add dword [esi + 0x40], 0x6c
xor eax, eax
inc eax
jmp 0x3001b6ce
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x3001b6d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push ebx
push dword [edi + 0x28]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
je 0x3001b75e
push ebx
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x3001b75e
cmp dword [ebp - 0x10], 4
jne 0x3001b75e
add dword [edi + 0x30], 4
lea eax, [esi + 0x10]
mov ebx, dword [eax]
jmp 0x3001b898
lea esi, [ebx - 0x418]
mov eax, dword [esi + 0x414]
test al, 1
mov ebx, dword [ebx]
je 0x3001b892
test al, 4
je 0x3001b767
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2e4]
lea eax, [esi + 0x18]
push eax
push edi
push dword [ebp + 8]
call fcn.3001b3e0
test eax, eax
jne 0x3001b76b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
and dword [ebp - 8], 0
test byte [esi + 0x414], 2
je 0x3001b79d
mov eax, dword [esi + 0x2f0]
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [esi + 0x2e8]
sub ecx, eax
push ecx
push eax
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push edi
push dword [ebp + 8]
call fcn.3001b512
test eax, eax
je 0x3001b75e
jmp 0x3001b7a1
and dword [ebp + 0xc], 0
test byte [esi + 0x414], 8
je 0x3001b7cf
lea eax, [ebp - 4]
push eax
push dword [esi + 0x300]
mov eax, dword [ebp + 0x10]
push dword [esi + 0x2f8]
push dword [eax + 4]
push edi
push dword [ebp + 8]
call fcn.3001b512
test eax, eax
je 0x3001b75e
jmp 0x3001b7d3
and dword [ebp - 4], 0
test byte [esi + 0x414], 0x10
je 0x3001b80d
mov eax, dword [esi + 0x310]
test eax, eax
jbe 0x3001b80d
push 0
push eax
push dword [esi + 0x30c]
lea eax, [esi + 0x314]
push dword [esi + 0x308]
push eax
push edi
push dword [ebp + 8]
call fcn.3001b444
test eax, eax
je 0x3001b75e
mov eax, dword [esi]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0x14]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
lea eax, [esi + 0x2f0]
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
mov ecx, dword [esi + 0x2e8]
sub ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [esi + 0x2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x2fc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x300]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x2e4]
push 0
push dword [edi + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebp + 8]
call fcn.3001b56f
mov eax, dword [ebp + 0x10]
add eax, 0x10
cmp ebx, eax
jne 0x3001b729
xor eax, eax
inc eax
jmp 0x3001b760
Function at 0x3001b8a8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x84
push ebx
push esi
mov esi, dword [ebp + 0x7c]
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [ebp + 0x78]
xor ebx, ebx
push ebx
push ebx
push dword [edi + 0x40]
mov dword [ebp + 0x5c], eax
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
je 0x3001b95c
push ebx
lea eax, [ebp + 0x54]
push eax
push 4
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x3001b95c
cmp dword [ebp + 0x54], 4
jne 0x3001b95c
add dword [edi + 0x40], 4
lea ecx, [esi + 0x18]
mov eax, dword [ecx]
cmp eax, ecx
je 0x3001ba4f
jmp 0x3001b90e
mov eax, dword [ebp + 0x60]
lea ebx, [eax - 0x280]
test byte [ebx + 0x26c], 1
mov eax, dword [eax]
mov dword [ebp + 0x60], eax
je 0x3001ba43
lea eax, [ebp + 0x58]
push eax
lea eax, [ebx + 0x60]
push eax
push edi
push dword [ebp + 0x74]
call fcn.3001b5d3
test eax, eax
je 0x3001b95c
mov ecx, dword [ebx + 0x50]
test ecx, ecx
je 0x3001b968
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x3001b968
lea edx, [ebp + 0x64]
push edx
push eax
push ecx
push edi
push dword [ebp + 0x74]
call fcn.3001b3e0
test eax, eax
jne 0x3001b96c
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
and dword [ebp + 0x64], 0
test byte [ebx + 0x26c], 4
je 0x3001b998
mov ecx, dword [ebx + 0x58]
test ecx, ecx
je 0x3001b998
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x3001b998
lea edx, [ebp + 0x68]
push edx
push eax
push ecx
push edi
push dword [ebp + 0x74]
call fcn.3001b3e0
test eax, eax
je 0x3001b95c
jmp 0x3001b99c
and dword [ebp + 0x68], 0
test byte [ebx + 0x26c], 2
je 0x3001b9d0
lea edi, [ebx + 0x270]
mov esi, dword [edi]
jmp 0x3001b9cc
push 0
lea eax, [esi - 0xc]
push dword [eax + 8]
mov esi, dword [esi]
push dword [eax]
mov eax, dword [ebp + 0x7c]
push dword [eax + 4]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.3001b512
cmp esi, edi
jne 0x3001b9af
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x64]
push 0xd
pop ecx
lea esi, [ebx + 0x1c]
lea edi, [ebp]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x38], eax
mov eax, dword [ebx + 0x54]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x40], eax
mov eax, dword [ebx + 0x5c]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp + 0x58]
mov dword [ebp - 4], eax
xor eax, eax
push eax
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x50], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.3001b672
test eax, eax
je 0x3001b95c
mov esi, dword [ebp + 0x7c]
mov edi, dword [ebp + 0x78]
lea eax, [esi + 0x18]
cmp dword [ebp + 0x60], eax
jne 0x3001b90b
xor eax, eax
inc eax
jmp 0x3001b95e
Function at 0x3001c94b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push edi
mov edi, dword [ebp + 0xc]
cmp word [edi + 6], 0
movzx eax, word [edi + 0x14]
lea ebx, [eax + edi + 0x18]
jbe 0x3001c9d8
push esi
mov esi, dword [ebp + 8]
add ebx, 0x24
mov eax, dword [ebx]
test eax, eax
jns 0x3001c9c8
test eax, 0x40000000
je 0x3001c9c8
test al, 0xc0
je 0x3001c9c8
push 0x18
call fcn.3001c7a2
test eax, eax
je 0x3001c9c8
mov ecx, dword [ebx - 0x18]
xor edx, edx
add ecx, dword [esi + 8]
adc edx, dword [esi + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov ecx, dword [ebx - 0x1c]
mov dword [eax + 8], ecx
lea ecx, [esi + 0x270]
mov edi, dword [ecx + 4]
lea edx, [eax + 0xc]
mov dword [eax + 0x10], edi
mov dword [edx], ecx
mov dword [edi], edx
mov edi, dword [ebp + 0xc]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
add dword [esi + 0x278], eax
inc dword [esi + 0x27c]
movzx eax, word [edi + 6]
inc dword [ebp - 4]
add ebx, 0x28
cmp dword [ebp - 4], eax
jb 0x3001c96e
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x3001c9e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 8], ebx
jne 0x3001ca0a
xor eax, eax
jmp 0x3001ca4f
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0xffffffff
mov ecx, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ecx], eax
je 0x3001ca47
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x3001ca47
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push ebx
mov esi, eax
call edi
push dword [ebp + 8]
call edi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x3001ca55
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 8], 0xffffffff
je 0x3001ca6d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
or dword [esi + 8], 0xffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 4], 0
push esi
call fcn.3001c7b8
pop esi
ret 4
Function at 0x3001ce23
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfb8
push ebx
push esi
push edi
push 0x420
call fcn.3001c7a2
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x3001cfd9
mov eax, dword [ebp + 0xc]
push eax
push edi
push 0x1f03ff
mov dword [esi], eax
call fcn.3001cd47
cmp eax, edi
mov dword [esi + 4], eax
je 0x3001cfcd
push eax
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
mov dword [esi + 8], eax
lea eax, [esi + 0x18]
push eax
push dword [esi + 4]
mov dword [esi + 0x414], 0x17
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [eax], 0x1003f
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
cmp eax, edi
je 0x3001cfcd
push dword [esi + 4]
mov dword [esi + 0x2e4], 0x2cc
call fcn.3001cda6
cmp eax, edi
je 0x3001cfcd
mov ebx, dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
lea ecx, [ebp - 4]
push ecx
push 0x1c
lea ecx, [ebp - 0xfb8]
push ecx
push eax
push dword [ebp + 8]
mov dword [esi + 0x14], eax
call ebx
cmp eax, edi
je 0x3001cfd9
cmp dword [ebp - 4], 0x1c
jne 0x3001cfd9
mov ecx, dword [esi + 0xdc]
mov dword [esi + 0x2f8], edi
mov dword [esi + 0x2fc], edi
mov dword [esi + 0x300], edi
mov eax, dword [ebp - 0xfb4]
cdq
mov dword [esi + 0x2e8], eax
mov dword [esi + 0x2ec], edx
mov eax, dword [ebp - 0xfb0]
add ecx, 0xfffffffc
cdq
adc edi, 0xffffffff
cmp edx, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
ja 0x3001cf45
jb 0x3001cf26
cmp eax, ecx
ja 0x3001cf45
mov eax, dword [ebp - 0xfb4]
cdq
cmp edi, edx
ja 0x3001cf45
jb 0x3001cf37
cmp ecx, eax
jae 0x3001cf45
mov dword [esi + 0x2f0], ecx
mov dword [esi + 0x2f4], edi
jmp 0x3001cf57
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2f0], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2f4], eax
mov edi, dword [esi + 0xd0]
sub edi, 0x80
mov dword [ebp + 0xc], 0x100
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [esi + 0x314]
push eax
push edi
push dword [ebp + 8]
call ebx
test eax, eax
je 0x3001cf8f
mov eax, dword [ebp - 4]
add eax, edi
cmp eax, dword [esi + 0xd0]
ja 0x3001cfb3
mov eax, dword [esi + 0xd0]
xor eax, edi
test eax, 0xfffff000
je 0x3001cfae
mov eax, edi
neg eax
and eax, 0xfff
sub dword [ebp + 0xc], eax
add edi, eax
jmp 0x3001cf6a
xor edi, edi
mov dword [ebp - 4], edi
mov eax, edi
cdq
mov dword [esi + 0x308], eax
mov dword [esi + 0x30c], edx
mov eax, dword [ebp - 4]
mov dword [esi + 0x310], eax
jmp 0x3001cfd5
push esi
call fcn.3001c7b8
xor esi, esi
mov eax, esi
jmp 0x3001cfdb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x3001d3e0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
je 0x3001d405
cmp ecx, 0xffffffff
je 0x3001d405
cmp word [ecx], 0x5a4d
jne 0x3001d405
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x3001d405
xor eax, eax
ret 4

Function at 0x3001d408
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
jbe 0x3001d43c
mov edx, dword [eax + 0xc]
cmp dword [esp + 0x14], edx
jb 0x3001d434
mov edi, dword [eax + 0x10]
add edi, edx
cmp dword [esp + 0x14], edi
jb 0x3001d43e
add eax, 0x28
inc esi
cmp esi, ecx
jb 0x3001d420
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x3001d761
Capabilities:
Create thread
Resume thread
Suspend thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x30001e20
push 0x300219ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5b4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x3001d75f
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x3001d7b0
xor eax, eax
jmp 0x3001d86d
push dword [ebp - 0x20]
push ebx
push 0x1f03ff
call fcn.3001d6ef
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x3001d7ca
mov dword [ebp - 0x2c], ebx
jmp 0x3001d839
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x3001d832
mov edi, 0x10007
mov dword [ebp - 0x2f8], edi
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.DLL_GetThreadContext]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x3001d835
mov dword [ebp - 0x5c4], edi
lea eax, [ebp - 0x5c4]
push eax
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x3001d835
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x50c]
je 0x3001d835
jmp 0x3001d832
mov dword [ebp - 0x2c], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], ebx
jle 0x3001d847
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push 0xdead
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
cmp dword [ebp - 0x28], ebx
je 0x3001d86a
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret