joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f950
Capabilities:
Terminate process

Disassembly:
sub esp, 8
mov eax, dword [0x48cee8]
add eax, 0x47850f4f
or eax, 0x750f1493
mov dword [0x49b7bc], eax
mov eax, dword [0x49dbcc]
mov cx, word [0x48208a]
add ecx, 0xffffcaee
mov word [0x48208a], cx
mov cx, word [0x48a3c2]
movsx ecx, cx
mov edx, 0x9fc0610e
sub edx, ecx
add dword [0x491384], edx
mov dword [esp], eax
mov dword [esp + 4], 0x4e20
call dword [0x480e18]
sub esp, 8
mov cx, word [0x481632]
dec ecx
mov word [0x481632], cx
mov ecx, dword [0x492b84]
not ecx
imul ecx, ecx, 0x4bf56eda
add ecx, 0x4e961623
mov edx, dword [0x49bc60]
add edx, 0x29727943
and edx, 0x2ea14eea
cmp ecx, edx
jle 0x40f9f0
xor dword [0x495dc0], 0xfff79bfd
jmp 0x40f9f7
mov cx, word [0x483f86]
cmp eax, 0x80
je 0x40fa0e
test eax, eax
jne 0x40fa1a
xor dword [0x48edc4], 0x88888001
jmp 0x40fa28
or dword [0x492978], 0xf2f1582
jmp 0x40fa28
mov eax, dword [0x48b4e4]
shl eax, 5
or dword [0x4998c4], eax
mov dword [0x4916c0], 0x81080881
mov dword [esp], 1
call fcn.00452d90
int3

Function at 0x424a10
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [esp + 0x14]
mov eax, dword [0x49629c]
shl eax, 4
add eax, 0xf9694b6f
cmp eax, 0x104a8121
jl 0x424a39
mov dword [0x499ee0], 0x58379d3d
mov ax, word [0x48242e]
cwde
mov ecx, 0xdebcd09
sub ecx, eax
add dword [0x499884], ecx
mov dword [esp], edi
call fcn.0044ec40
xor dword [0x48fdb4], 0xd30272ab
mov ecx, dword [0x495660]
imul ecx, ecx, 0x20c5bf
mov dword [0x495660], ecx
mov dword [esi], 0
xor dword [0x48b208], 0x8bd87a6
mov dword [esi + 4], 0
mov cx, word [0x48641e]
movsx ecx, cx
mov edx, dword [0x48e2a4]
not edx
or edx, ecx
cmp edx, 0x5f01e256
jl 0x424ab8
mov cx, word [0x482186]
imul ecx, ecx, 0x6890
mov word [0x482186], cx
mov dword [esi + 8], 0x67452301
mov cx, word [0x489778]
movsx ecx, cx
sar ecx, 1
mov edx, dword [0x4961c8]
imul edx, ecx
imul ecx, edx, 0x37519fe3
mov dword [0x4961c8], ecx
mov dword [esi + 0xc], 0xefcdab89
mov ecx, dword [0x4931f8]
shr ecx, 5
mov dx, word [0x489c30]
imul edx, ecx
mov word [0x489c30], dx
mov dword [esi + 0x10], 0x98badcfe
mov cx, word [0x483c86]
movsx ecx, cx
or ecx, 0x3612c78d
mov edx, dword [0x48ab20]
xor edx, ecx
xor edx, 0xc9ed3872
mov dword [0x48ab20], edx
mov dword [esi + 0x14], 0x10325476
mov word [0x4859e6], 0xd954
add dword [0x4992bc], 0x3c606197
mov dword [esp + 4], eax
mov dword [esp], edi
mov ecx, esi
call fcn.0041e980
sub esp, 8
mov eax, dword [0x495da8]
imul eax, eax, 0x84928f50
mov dword [0x495da8], eax
mov ecx, esi
call fcn.0043afc0
mov eax, dword [0x490cd0]
mov ax, word [0x482004]
cwde
sar eax, 0xa
xor dword [0x4903bc], eax
mov ecx, esi
call fcn.00444a70
mov ax, word [0x482448]
or eax, 0x7bfb
mov word [0x482448], ax
add esi, 0xb9
mov eax, esi
add esp, 8
pop esi
pop edi
ret 4
Function at 0x439fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov word [0x481a5c], 0xbcd8
mov dx, word [0x4858f8]
add edx, 0xffff8c59
xor edx, 0xffff805c
mov si, word [0x4872e8]
imul esi, edx
mov word [0x4872e8], si
mov dx, word [0x48337a]
lea esi, [edx - 1]
mov word [0x48337a], si
movsx edx, dx
mov esi, dword [0x498fe0]
and esi, edx
and esi, 0xe7008b74
mov dword [0x498fe0], esi
mov edx, dword [0x493100]
imul edx, edx, 0x4e222
mov dword [0x493100], edx
lea edx, [ecx + ebp*4]
mov esi, dword [0x496b30]
mov di, word [0x48298c]
inc edi
mov word [0x48298c], di
movsx edi, di
lea esi, [edi + esi*4]
or dword [0x493310], esi
mov si, word [0x4852ba]
movsx esi, si
and esi, 0x7fffffff
cmp esi, 0x18324aa2
je 0x43a07f
mov si, word [0x4876fa]
mov si, word [0x481388]
add esi, 0xffffce1b
mov word [0x481388], si
mov esi, eax
shr esi, 8
mov edi, eax
shr edi, 0x10
mov ebx, eax
shr ebx, 0x18
cmp ecx, edx
je 0x43a14a
shl ebp, 2
nop
nop
nop
nop
nop
nop
nop
mov dword [esp], ecx
mov edx, dword [0x48e01c]
and edx, 0x4d70
mov ecx, ebp
mov bp, word [0x48191a]
xor ebp, edx
xor ebp, 0x41a5
mov word [0x48191a], bp
mov ebp, ecx
mov ecx, dword [esp]
shl ebx, 0x18
shl edi, 0x10
and edi, 0xff0000
or edi, ebx
shl esi, 8
movzx esi, si
or esi, edi
movzx edx, al
or edx, esi
xor dword [ecx], edx
mov bx, word [0x48156c]
inc ebx
mov word [0x48156c], bx
shr edx, 6
shl eax, 0x1a
or eax, edx
shr esi, 0xe
shr edi, 0x16
mov ebx, eax
shr ebx, 0x18
mov ax, word [0x4851a0]
or eax, 0xfbff
mov word [0x4851a0], ax
add edi, esi
mov ax, word [0x4867da]
or eax, 0xebff
mov word [0x4867da], ax
add esi, edi
mov word [0x484942], 0x51b4
add ecx, 4
add ebp, 0xfffffffc
mov eax, edx
jne 0x43a0a0
jmp 0x43a14c
mov edx, eax
mov eax, dword [0x48c62c]
mov ecx, dword [0x48c710]
imul ecx, eax
mov dword [0x48c710], ecx
shl ebx, 0x18
shl edi, 0x10
and edi, 0xff0000
or edi, ebx
shl esi, 8
movzx ecx, si
or ecx, edi
movzx eax, dl
or eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
call fcn.00424c10
mov edi, eax
mov eax, dword [0x4903d4]
mov ecx, dword [0x495418]
lea edx, [ecx + 1]
mov dword [0x495418], edx
mov edx, dword [0x48dbd4]
add eax, ecx
lea eax, [edx + eax - 0x5bf28eca]
mov dword [0x48dbd4], eax
mov ax, word [0x483eb8]
cwde
and eax, 0xff47aa0a
mov cx, word [0x483430]
movsx ecx, cx
not ecx
cmp eax, ecx
jle 0x44409f
add dword [0x48f5f8], 0x5e567cf
jmp 0x4440a9
or dword [0x499ae0], 0x8a51fe08
xor dword [0x49c664], 0x7dcec03d
mov ax, word [0x484a4c]
cwde
imul eax, eax, 0x7b08b6e1
add dword [0x496b14], eax
mov ebx, dword [esi + 4]
add edi, 0xffffffe4
cmp edi, ebx
jl 0x444127
mov eax, dword [0x49030c]
mov ecx, 0xc56ab64f
sub ecx, eax
mov ax, word [0x486ce2]
add eax, ecx
mov word [0x486ce2], ax
mov ecx, ebx
call fcn.00447b10
xor dword [0x48ce14], 0x42e11283
mov dword [ebx + 0x18], 0
mov ax, word [0x484f04]
add eax, 0x2f60
mov word [0x484f04], ax
mov dword [ebx], 0x46f2e4
mov ecx, ebx
call fcn.00447840
add ebx, 0x1c
cmp ebx, edi
jle 0x4440d0
mov dword [esp + 4], 1
mov dword [esp], 0
mov ecx, esi
call fcn.004380b0
pop esi
pop edi
pop ebx
ret
Function at 0x444ce0
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
or dword [0x48e8a4], 0x2cc5ae30
mov eax, dword [0x48b1ec]
cmp eax, 0xff7b32db
jl 0x444d17
mov eax, dword [0x4947bc]
xor eax, 0x4325f541
cmp eax, 0x9e67e35b
jg 0x444d17
add dword [0x492a14], 0x6867b7e2
mov ax, word [0x485362]
xor eax, 0xa0
mov word [0x485362], ax
mov dword [esp], esi
call fcn.0044ec40
mov cx, word [0x4810c2]
xor ecx, 0xe06b
mov word [0x4810c2], cx
add dword [0x4944f0], 0x85a3b53
movzx ecx, byte [eax + esi - 1]
cmp ecx, 0x22
jne 0x444e27
mov cx, word [0x486426]
movsx ecx, cx
mov edx, 0x3fa40b10
sub edx, ecx
mov ecx, dword [0x494e60]
xor ecx, edx
xor ecx, 0xea3e8855
mov dword [0x494e60], ecx
mov byte [esi], 0x22
mov cx, word [0x485a14]
movsx ecx, cx
shl ecx, 6
add ecx, 0xe5c40d34
mov edx, dword [0x496a08]
imul edx, ecx
mov dword [0x496a08], edx
mov byte [esi + eax - 1], 0
mov cx, word [0x489fd6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov cx, word [0x48512a]
or ecx, 0xccdc
mov word [0x48512a], cx
mov ecx, dword [0x497b44]
or ecx, 0xf6497c32
mov edx, dword [0x48a9f0]
imul edx, ecx
mov dword [0x48a9f0], edx
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x22
jne 0x444dc0
mov ecx, dword [0x48d3f0]
add ecx, 0x36f00482
xor ecx, 0xb2161962
cmp ecx, 0x634dd34d
jl 0x444ebb
mov dword [0x49944c], 0x9e08265f
jmp 0x444ed6
mov cx, word [0x48516c]
add ecx, 0x2001
mov word [0x48516c], cx
mov byte [esi], 0x20
mov cx, word [0x4815b4]
add ecx, 0xffff8b0b
mov word [0x4815b4], cx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add dword [0x48eb64], 0x3f7377fe
mov cx, word [0x48a1ac]
movsx ecx, cx
sar ecx, 3
add ecx, 0x9ec536c4
xor ecx, 0x6d0c5285
mov edx, dword [0x499344]
imul edx, ecx
mov dword [0x499344], edx
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x20
jne 0x444e60
mov ecx, dword [0x49ba00]
imul ecx, ecx, 0xf7325362
mov dword [0x49ba00], ecx
and dword [0x491428], 0x49c27fe
jmp 0x444eea
mov cx, word [0x484b4a]
movsx ecx, cx
not ecx
mov edx, dword [0x48bb54]
imul edx, ecx
mov dword [0x48bb54], edx
mov cx, word [0x4826ee]
and ecx, 0x96ef
mov word [0x4826ee], cx
add esi, eax
and dword [0x493e04], 0x167f6d54
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x459a81
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47fde0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0045710a
mov dword [ebp - 0x14], eax
cmp dword [0x49ee3c], esi
jne 0x459b74
push 0x800
push esi
push 0x470250
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x459b01
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x459c54
push esi
push esi
push 0x470250
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x459c54
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x459c54
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x49ee3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49ee40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49ee44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49ee4c], eax
test eax, eax
je 0x459b71
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49ee48], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x459b99
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x459b8c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x459bae
push 4
pop eax
jmp 0x459c56
cmp dword [ebp - 0x14], esi
je 0x459bae
push dword [0x49ee3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x459b93
mov eax, dword [0x49ee48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x459c0c
cmp dword [0x49ee4c], edi
je 0x459c0c
push eax
call ebx
push dword [0x49ee4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x459c0c
test eax, eax
je 0x459c0c
call ecx
test eax, eax
je 0x459c01
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x459c01
test byte [ebp - 8], 1
jne 0x459c0c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x459c3c
mov eax, dword [0x49ee40]
cmp eax, edi
je 0x459c39
push eax
call ebx
test eax, eax
je 0x459c39
call eax
mov esi, eax
test esi, esi
je 0x459c39
mov eax, dword [0x49ee44]
cmp eax, edi
je 0x459c39
push eax
call ebx
test eax, eax
je 0x459c39
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x49ee3c]
call ebx
test eax, eax
je 0x459c54
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x459c56
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459c85
mov esp, ebp
pop ebp
ret
Function at 0x303215b
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x310e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x424], edx
xor ebx, ebx
test esi, esi
je 0x30322af
cmp byte [esi], bl
je 0x30322af
push 0x105
lea edx, [ebp - 0x420]
call fcn.030426c9
push esi
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.0307d4b8
add esp, 0xc
xor ecx, ecx
call fcn.0304f302
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
mov dword [ebp - 0x428], eax
inc ecx
call fcn.0304f302
mov eax, dword [ebp - 0x428]
cmp eax, 0xffffffff
je 0x30322af
test al, 0x10
jne 0x30322af
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x30322af
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x303229f
mov eax, 0x104
cmp edi, eax
ja 0x303229f
push eax
lea eax, [ebp - 0x10c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x42c]
push ebx
push eax
push edi
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x303229f
cmp dword [ebp - 0x42c], edi
jne 0x303229f
inc ebx
lea eax, [ebp - 0x10c]
cmp byte [ebp - 0x10c], 0
je 0x3032285
mov cl, byte [eax]
cmp cl, 0xa
je 0x3032282
cmp cl, 0xd
je 0x3032282
inc eax
cmp byte [eax], 0
jne 0x303226e
jmp 0x3032285
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
push 0x105
push dword [ebp - 0x424]
call fcn.0307d4b8
add esp, 0xc
pop edi
test esi, esi
je 0x30322ab
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x30322b1
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0307c5f7
mov esp, ebp
pop ebp
ret
Function at 0x3032d7d
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x310e008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0x120]
cmp word [ecx], 0
jne 0x3032da9
lea ecx, [esi + 0x1e]
push 0x105
lea edx, [edi + 4]
call fcn.03042678
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x3032dcf
push 0x3016888
call dword [0x3113310]
pop ecx
jmp 0x3032f86
cmp dword [esi + 0x540], 8
jne 0x3032de0
xor eax, eax
inc eax
jmp 0x3032f88
lea eax, [ebp - 0x280]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push dword [esi + 0xc]
push dword [esi + 8]
call dword [0x3113324]
test eax, eax
je 0x3032f72
cmp dword [ebp - 0x280], 0x40
jne 0x3032f72
mov eax, 0x5a4d
cmp word [ebp - 0x4c], ax
jne 0x3032f0f
lea eax, [ebp - 0x280]
mov ebx, 0xf8
push eax
push ebx
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esi + 8]
adc edx, dword [esi + 0xc]
push edx
push eax
call dword [0x3113324]
test eax, eax
je 0x3032ee0
cmp dword [ebp - 0x280], ebx
jne 0x3032ee0
cmp dword [ebp - 0x174], 0x4550
mov eax, dword [ebp - 0x16c]
mov dword [edi + 0x110], eax
je 0x3032e98
lea eax, [ebx + 0xf]
cmp word [ebp - 0x15c], ax
jne 0x3032e8e
lea eax, [ebp - 0x170]
mov dword [0x31131ec], eax
mov eax, dword [ebp - 0x158]
jmp 0x3032f07
push 0x30168f0
jmp 0x3032dc3
mov eax, 0x20b
cmp word [ebp - 0x15c], ax
jne 0x3032ef6
lea eax, [ebp - 0x280]
mov ebx, pe_nt_image_headers32
push eax
push ebx
lea eax, [ebp - 0x27c]
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esi + 8]
adc edx, dword [esi + 0xc]
push edx
push eax
call dword [0x3113324]
test eax, eax
je 0x3032ee0
cmp dword [ebp - 0x280], ebx
jne 0x3032ee0
mov eax, dword [ebp - 0x22c]
jmp 0x3032f07
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esi + 8]
adc edx, dword [esi + 0xc]
push edx
push eax
push 0x30168cc
jmp 0x3032f7d
lea eax, [ebp - 0x170]
mov dword [0x31131ec], eax
mov eax, dword [ebp - 0x124]
mov dword [edi + 0x114], eax
jmp 0x3032f49
mov eax, 0x4944
cmp word [ebp - 0x4c], ax
jne 0x3032f68
lea eax, [ebp - 0x280]
push eax
push 0x30
lea eax, [ebp - 0x7c]
push eax
push dword [esi + 0xc]
push dword [esi + 8]
call dword [0x3113324]
test eax, eax
je 0x3032f5b
cmp dword [ebp - 0x280], 0x30
jne 0x3032f5b
mov eax, dword [ebp - 0x74]
mov dword [edi + 0x110], eax
lea ecx, [esi + 0x4918]
mov edx, edi
call fcn.0304cceb
jmp 0x3032dd8
push dword [esi + 0xc]
push dword [esi + 8]
push 0x301690c
jmp 0x3032f7d
push 0x3016934
jmp 0x3032dc3
push dword [esi + 0xc]
push dword [esi + 8]
push 0x30168ac
call dword [0x3113310]
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0307c5f7
mov esp, ebp
pop ebp
ret 4
Function at 0x30363fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x310f9d8]
cmp eax, 0xffffffff
jne 0x3036407
xor eax, eax
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x3036449
push edi
mov edi, 0x388
mov ecx, edi
call fcn.0303767c
mov esi, eax
test esi, esi
je 0x3036443
push esi
push dword [0x310f9d8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x3036448
mov esi, 0x311fc28
pop edi
mov eax, esi
pop esi
ret

Function at 0x30373c5
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x30373dd
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x3037410
movzx eax, word [edx + 0x14]
lea ecx, [edx + 0x18]
push esi
push edi
movzx edi, word [edx + 6]
add ecx, eax
xor esi, esi
test edi, edi
je 0x303740c
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x3037404
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0xc]
cmp edx, eax
jb 0x3037414
add ecx, 0x28
inc esi
cmp esi, edi
jb 0x30373f5
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
mov eax, ecx
jmp 0x303740e

Function at 0x3037475
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x310ae60
call fcn.0307e324
xor edx, edx
test ecx, ecx
je 0x30374d1
cmp ecx, 0xffffffff
je 0x30374d1
mov dword [ebp - 4], edx
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x30374ca
mov eax, dword [ecx + 0x3c]
test eax, eax
js 0x30374ca
cmp eax, 0x10000000
jae 0x30374ca
add eax, ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [eax]
sub edx, 0x4550
neg edx
sbb edx, edx
not edx
and edx, eax
jmp 0x30374c7
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
call fcn.0307e369
ret
Function at 0x303750e
Capabilities:
Allocate thread local storage

Disassembly:
push 8
push 0x310ae80
call fcn.0307e324
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
sub eax, esi
je 0x30375bd
dec eax
je 0x3037544
dec eax
dec eax
jne 0x3037622
call fcn.03036fea
call fcn.030374de
jmp 0x3037622
mov eax, dword [ebp + 8]
mov dword [0x310f9d0], eax
mov dword [0x310f9dc], 0x94
push 0x310f9dc
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0xf0
push esi
push 0x3111a30
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x3111b24
push 0x105
call dword [0x3112600]
push 0x310fa84
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call esi
push 0x3111d34
call esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x310f9d4], eax
test eax, eax
je 0x3037635
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x310f9d8], eax
cmp eax, 0xffffffff
jne 0x3037622
jmp 0x3037635
call fcn.030374de
mov eax, dword [0x310f9d8]
or esi, 0xffffffff
cmp eax, esi
je 0x30375db
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x310f9d8], esi
mov eax, dword [0x310fa9c]
test eax, eax
je 0x30375ef
cmp eax, esi
je 0x30375ef
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x310facc]
test eax, eax
je 0x3037603
cmp eax, esi
je 0x3037603
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x3111b20]
call fcn.030386c9
push 0x310fa84
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call esi
push 0x3111d34
call esi
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x303763e
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.0307e369
ret 0xc

Function at 0x30387c6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x310fa9c]
push ebx
test eax, eax
je 0x303887e
cmp eax, 0xffffffff
je 0x303887e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
push 0x310fa84
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [0x3111d2e], 0
je 0x3038823
push 0x310fa84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x7530
jb 0x30387e5
xor ebx, ebx
jmp 0x303885f
mov eax, dword [0x310faa4]
test eax, eax
je 0x303882e
call eax
push dword [0x310fa9c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
push 0x310fa84
mov dword [0x310fa9c], ebx
mov dword [0x310faa0], ebx
mov dword [0x310faa4], ebx
mov dword [0x310faa8], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x310fa9c], 0
je 0x303887e
call fcn.030320ab
test eax, eax
je 0x303887e
push 0x3018698
push ebx
call fcn.0304a010
pop ecx
pop ecx
pop ebx
ret
Function at 0x3038d26
Capabilities:
Check if file exists
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x310e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x3111d58]
test ecx, ecx
js 0x3038d51
xor eax, eax
test ecx, ecx
sete al
jmp 0x3038e68
push esi
push edi
mov esi, 0x105
lea eax, [ebp - 0x258]
push esi
push eax
xor edi, edi
push edi
call dword [0x31125f4]
test eax, eax
je 0x3038e66
push ebx
push edi
push edi
push edi
push edi
push 0x101
lea eax, [ebp - 0x45c]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0307db8f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x258]
push esi
push eax
call fcn.0307d822
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x258]
push esi
push eax
call fcn.0307d796
push 0x3018cc8
lea eax, [ebp - 0x258]
push esi
push eax
call fcn.0307d796
add esp, 0x48
lea eax, [ebp - 0x258]
xor ebx, ebx
inc ebx
push edi
push 0x80
push 3
push edi
push ebx
push 0x80000000
push eax
call dword [0x31125cc]
mov esi, eax
test esi, esi
je 0x3038e52
cmp esi, 0xffffffff
je 0x3038e52
push edi
lea eax, [ebp - 0x460]
mov dword [0x3111d58], ebx
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3038e3e
cmp dword [ebp - 0x460], 0x11
jbe 0x3038e3e
push 0x11
lea eax, [ebp - 0x4c]
push 0x3018cec
push eax
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
neg eax
sbb eax, eax
and dword [0x3111d58], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x3111d58], eax
sete al
jmp 0x3038e65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x3038e63
mov dword [0x3111d58], ebx
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0307c5f7
mov esp, ebp
pop ebp
ret

Function at 0x303a9ae
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov edi, esi
jmp 0x303a9cb
movsx eax, byte [ebx + edx - 1]
and eax, 0xdf
or edi, eax
shl edi, 8
dec edx
test dl, 3
jne 0x303a9bb
shr edx, 2
mov ecx, esi
test edx, edx
jle 0x303a9eb
mov eax, dword [ebx + ecx*4]
and eax, 0xdfdfdfdf
xor esi, eax
rol esi, 4
inc ecx
cmp ecx, edx
jl 0x303a9d9
xor esi, edi
xor edx, edx
mov eax, esi
mov ecx, 0xfd
div ecx
pop edi
pop esi
mov eax, edx
pop ebx
ret