joyce8/EMBER2024-capa huggingface dataset:
Function at 0x301ae930
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
push edi
lea ecx, [esp + 0x18]
push ecx
mov dword [esi + 0x30], eax
mov byte [esi + 0x110], 0
mov byte [esi + 0x119], 1
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
lea edi, [esi + 0x150]
mov ebx, 0x28
mov ecx, dword [edi + 0xa0]
call fcn.301af9e0
mov ecx, dword [edi]
call fcn.301af9e0
mov ecx, dword [edi + 0x140]
call fcn.301af9e0
add edi, 4
dec ebx
jne 0x301ae963
mov edi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0
push 1
lea ebx, [esi + 0x348]
push ebx
call edi
test eax, eax
je 0x301ae9b2
mov ebp, dword [sym.imp.kernel32.dll_Sleep]
push 0
call ebp
push 0
push 1
push ebx
call edi
test eax, eax
jne 0x301ae9a3
mov edi, dword [esi + 0x34c]
test edi, edi
je 0x301ae9e4
lea ebp, [esi + 0x11c]
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
push ebp
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call fcn.301ade60
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x301ae9c2
push 0
push ebx
call dword [sym.imp.kernel32.dll_InterlockedExchange]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov edi, dword [esi + 0x28]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esi + 0x2c]
sub eax, ebp
sbb ecx, ebx
add edi, eax
adc edx, ecx
push 0xa
mov ecx, esi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edx
call fcn.300e6c17
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x301aef80
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esp + 4]
add esp, 0x24
ret

Function at 0x301af000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
neg cl
lea eax, [esp]
push eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], 0
sbb ecx, ecx
and ecx, 0xffffffe0
add ecx, 0x40
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
pop ecx
ret 0xc
Function at 0x301bf5b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ecx, eax
jne 0x301bf5c3
mov ecx, 1
mov eax, ecx
shl eax, 0x10
cdq
idiv ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0x28], ecx
mov ebp, eax
mov eax, dword [esp + 0x20]
mov edx, ebp
imul edx, esi
mov edi, edx
dec eax
sar edi, 0x10
cmp edi, eax
jl 0x301bf600
mov edi, edi
sub edx, ebp
mov edi, edx
sar edi, 0x10
inc ecx
cmp edi, eax
jge 0x301bf5f0
mov dword [esp + 0x28], ecx
mov edi, dword [esp + 0x18]
sub esi, ecx
test esi, esi
jle 0x301bf64a
mov dword [esp + 0x24], esi
mov edi, edi
movzx esi, bh
mov edx, ebx
sar edx, 0x10
movzx ecx, byte [edx + edi]
movzx edx, byte [edi + edx + 1]
mov eax, esi
imul edx, esi
xor eax, 0xff
imul ecx, eax
mov eax, dword [esp + 0x14]
add ecx, edx
sar ecx, 8
mov byte [eax], cl
add ebx, ebp
inc eax
mov dword [esp + 0x14], eax
dec dword [esp + 0x24]
jne 0x301bf610
mov ecx, dword [esp + 0x28]
sar ebx, 0x10
test ecx, ecx
movzx eax, byte [ebx + edi]
jle 0x301bf673
mov edi, dword [esp + 0x14]
mov bl, al
mov bh, bl
mov edx, ecx
shr ecx, 2
mov eax, ebx
shl eax, 0x10
mov ax, bx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x301ccbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x304]
push ebx
push ebp
mov ebp, dword [eax + 0x308]
push esi
mov esi, dword [eax + 0x300]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x310]
add eax, 0xd8
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
xor edi, edi
jmp 0x301ccc30
mov ecx, dword [esp + 0x14]
xor edi, edi
jmp 0x301ccc30
mov ecx, dword [esp + 0x14]
lea esp, [esp]
cmp ebp, 0xf
jge 0x301ccc5c
mov eax, 0xe
sub eax, ebp
shr eax, 3
inc eax
lea ebp, [ebp + eax*8]
mov edx, dword [esp + 0x10]
movzx ebx, byte [ecx]
shl edx, 8
add edx, ebx
inc ecx
dec eax
mov dword [esp + 0x10], edx
jne 0x301ccc44
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x24]
movzx eax, byte [eax + edi + 0x149]
mov ecx, esi
shr ecx, 6
mov edx, eax
and edx, 0xfffffffc
movzx ebx, byte [ecx + edx + 0x302649b8]
sub esi, ebx
mov ecx, ebp
mov edx, esi
shl edx, cl
mov ecx, dword [esp + 0x10]
and eax, 0xfffffffe
cmp ecx, edx
jb 0x301ccc98
mov esi, ecx
sub esi, edx
mov dword [esp + 0x10], esi
mov esi, ebx
dec eax
movzx ecx, byte [esi + 0x30264bd0]
movzx eax, byte [eax + 0x30264ac9]
sub ebp, ecx
shl esi, cl
mov ecx, dword [esp + 0x24]
mov edx, edi
not edx
mov byte [ecx + edi + 0x149], al
xor eax, edx
test al, 1
je 0x301cccc9
inc edi
cmp edi, 3
jl 0x301ccc28
mov ax, word [edi*8 + 0x30265128]
mov ecx, dword [esp + 0x1c]
mov word [ecx], ax
movzx edx, byte [edi*8 + 0x3026512c]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
mov dword [edi + eax*4], edx
inc eax
add ecx, 2
cmp eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jl 0x301ccc20
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 0x300], esi
pop esi
mov dword [eax + 0x308], ebp
pop ebp
mov dword [eax + 0x304], ecx
mov dword [eax + 0x310], edx
pop ebx
add esp, 0x10
ret 8
Function at 0x301f07c0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x301f07ee
mov edx, dword [esp]
mov dword [eax], edx
pop ecx
ret

Function at 0x301f3170
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
push ebx
push esi
add eax, 0x18
add edx, 4
push edi
mov dword [esp + 0x14], 8
xor ebx, ebx
nop
movzx esi, word [edx - 4]
mov edi, dword [eax - 0x18]
add esi, edi
cmp esi, ebx
jge 0x301f31a1
xor esi, esi
jmp 0x301f31af
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f31af
mov esi, edi
mov word [edx - 4], si
movzx esi, word [edx - 2]
mov edi, dword [eax - 0x14]
add esi, edi
cmp esi, ebx
jge 0x301f31c4
xor esi, esi
jmp 0x301f31d2
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f31d2
mov esi, edi
mov word [edx - 2], si
movzx esi, word [edx]
mov edi, dword [eax - 0x10]
add esi, edi
cmp esi, ebx
jge 0x301f31e6
xor esi, esi
jmp 0x301f31f4
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f31f4
mov esi, edi
mov word [edx], si
movzx esi, word [edx + 2]
mov edi, dword [eax - 0xc]
add esi, edi
cmp esi, ebx
jge 0x301f3208
xor esi, esi
jmp 0x301f3216
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f3216
mov esi, edi
mov word [edx + 2], si
movzx esi, word [edx + 4]
mov edi, dword [eax - 8]
add esi, edi
cmp esi, ebx
jge 0x301f322b
xor esi, esi
jmp 0x301f3239
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f3239
mov esi, edi
mov word [edx + 4], si
movzx esi, word [edx + 6]
mov edi, dword [eax - 4]
add esi, edi
cmp esi, ebx
jge 0x301f324e
xor esi, esi
jmp 0x301f325c
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f325c
mov esi, edi
mov word [edx + 6], si
movzx esi, word [edx + 8]
mov edi, dword [eax]
add esi, edi
cmp esi, ebx
jge 0x301f3270
xor esi, esi
jmp 0x301f327e
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f327e
mov esi, edi
mov word [edx + 8], si
movzx esi, word [edx + 0xa]
mov edi, dword [eax + 4]
add esi, edi
cmp esi, ebx
jge 0x301f3293
xor esi, esi
jmp 0x301f32a1
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x301f32a1
mov esi, edi
mov word [edx + 0xa], si
add edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax - 4], ebx
mov dword [eax - 8], ebx
mov dword [eax - 0xc], ebx
mov dword [eax - 0x10], ebx
mov dword [eax - 0x14], ebx
mov dword [eax - 0x18], ebx
add eax, 0x20
dec esi
mov dword [esp + 0x14], esi
jne 0x301f3190
pop edi
pop esi
pop ebx
ret
Function at 0x30205660
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
jle 0x302056d0
push ebx
mov al, byte [esi]
mov cl, byte [edi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp], al
mov al, byte [esi + 1]
mov cl, byte [edi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 1], al
mov al, byte [esi + 2]
mov cl, byte [edi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 2], al
mov al, byte [esi + 3]
mov cl, byte [edi + 3]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x1c]
shr bl, 1
sub al, bl
mov ebx, dword [esp + 0x24]
mov byte [ebp + 3], al
add esi, dword [esp + 0x20]
add edi, ebx
add ebp, ecx
dec edx
jne 0x30205672
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x30205cf0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
jle 0x30205db4
push ebx
mov al, byte [esi]
mov cl, byte [edi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp], al
mov al, byte [esi + 1]
mov cl, byte [edi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 1], al
mov al, byte [esi + 2]
mov cl, byte [edi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 2], al
mov al, byte [esi + 3]
mov cl, byte [edi + 3]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 3], al
mov al, byte [esi + 4]
mov cl, byte [edi + 4]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 4], al
mov al, byte [esi + 5]
mov cl, byte [edi + 5]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 5], al
mov al, byte [esi + 6]
mov cl, byte [edi + 6]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 6], al
mov al, byte [esi + 7]
mov cl, byte [edi + 7]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x1c]
shr bl, 1
sub al, bl
mov ebx, dword [esp + 0x24]
mov byte [ebp + 7], al
add esi, dword [esp + 0x20]
add edi, ebx
add ebp, ecx
dec edx
jne 0x30205d06
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x302068b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
push esi
push edi
mov edi, eax
mov esi, ecx
jle 0x30206915
push ebx
mov cl, byte [edi]
mov al, byte [esi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi], al
mov cl, byte [edi + 1]
mov al, byte [esi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 1], al
mov cl, byte [edi + 2]
mov al, byte [esi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 2], al
mov al, byte [esi + 3]
mov cl, byte [edi + 3]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x14]
shr bl, 1
sub al, bl
mov byte [esi + 3], al
add edi, edx
add esi, ecx
dec ebp
jne 0x302068c0
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x30206920
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
jle 0x302069cd
push ebx
mov al, byte [edi]
mov cl, byte [ebp]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi], cl
mov al, byte [edi + 1]
mov cl, byte [ebp + 1]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 1]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 1], cl
mov al, byte [edi + 2]
mov cl, byte [ebp + 2]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 2]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 2], cl
mov al, byte [edi + 3]
mov cl, byte [ebp + 3]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 3]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
mov eax, dword [esp + 0x20]
shr bl, 1
sub cl, bl
mov ebx, dword [esp + 0x24]
mov byte [esi + 3], cl
mov ecx, dword [esp + 0x1c]
add edi, eax
add ebp, ebx
add esi, ecx
dec edx
jne 0x30206936
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x30207030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
push esi
push edi
mov edi, eax
mov esi, ecx
jle 0x302070e9
push ebx
mov cl, byte [edi]
mov al, byte [esi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi], al
mov cl, byte [edi + 1]
mov al, byte [esi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 1], al
mov cl, byte [edi + 2]
mov al, byte [esi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 2], al
mov cl, byte [edi + 3]
mov al, byte [esi + 3]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 3], al
mov cl, byte [edi + 4]
mov al, byte [esi + 4]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 4], al
mov cl, byte [edi + 5]
mov al, byte [esi + 5]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 5], al
mov cl, byte [edi + 6]
mov al, byte [esi + 6]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 6], al
mov al, byte [esi + 7]
mov cl, byte [edi + 7]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x14]
shr bl, 1
sub al, bl
mov byte [esi + 7], al
add edi, edx
add esi, ecx
dec ebp
jne 0x30207044
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x302070f0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
jle 0x3020721d
push ebx
mov al, byte [edi]
mov cl, byte [ebp]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov cl, byte [esi]
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi], cl
mov al, byte [edi + 1]
mov cl, byte [ebp + 1]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 1]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 1], cl
mov al, byte [edi + 2]
mov cl, byte [ebp + 2]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 2]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 2], cl
mov al, byte [edi + 3]
mov cl, byte [ebp + 3]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 3]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 3], cl
mov al, byte [edi + 4]
mov cl, byte [ebp + 4]
mov bl, al
xor bl, cl
shr bl, 1
or al, cl
mov cl, byte [esi + 4]
sub al, bl
mov bl, cl
xor bl, al
shr bl, 1
or cl, al
sub cl, bl
mov byte [esi + 4], cl
mov al, byte [edi + 5]
mov cl, byte [ebp + 5]
mov bl, al
xor bl, cl
shr bl, 1
or al, cl
mov cl, byte [esi + 5]
sub al, bl
mov bl, cl
xor bl, al
shr bl, 1
or cl, al
sub cl, bl
mov byte [esi + 5], cl
mov al, byte [edi + 6]
mov cl, byte [ebp + 6]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 6]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 6], cl
mov al, byte [edi + 7]
mov cl, byte [ebp + 7]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 7]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
mov eax, dword [esp + 0x20]
shr bl, 1
sub cl, bl
mov ebx, dword [esp + 0x24]
mov byte [esi + 7], cl
mov ecx, dword [esp + 0x1c]
add edi, eax
add ebp, ebx
add esi, ecx
dec edx
jne 0x30207106
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x3022dab7
Capabilities:
Terminate process

Disassembly:
push 8
push 0x3026ff80
call fcn.3022c09c
push 8
call fcn.300e6c17
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x30378c84], esi
jne 0x3022daeb
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x30378c80], esi
mov al, byte [ebp + 0x10]
mov byte [0x30378c7c], al
cmp dword [ebp + 0xc], edi
jne 0x3022db35
cmp dword [0x3037a2f0], edi
je 0x3022db25
mov eax, dword [0x3037a2ec]
sub eax, 4
mov dword [0x3037a2ec], eax
cmp eax, dword [0x3037a2f0]
jb 0x3022db25
mov eax, dword [eax]
cmp eax, edi
je 0x3022db06
call eax
jmp 0x3022db06
push 0x30274034
mov eax, 0x3027402c
call fcn.3022da9f
pop ecx
push 0x3027403c
mov eax, 0x30274038
call fcn.3022da9f
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.3022db66
cmp dword [ebp + 0x10], edi
jne 0x3022db74
mov dword [0x30378c84], esi
push dword [ebp + 8]
call fcn.3022da5d
xor edi, edi
xor esi, esi
inc esi
call fcn.3022c0d7
ret
Function at 0x3022f681
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x302a3bc0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x3022f6b2
xor eax, eax
jmp 0x3022f83b
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x30379fa0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x3022f6ee
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.300e6c17
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x3022f7c9
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x3022f807
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x3022f752
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x3022f743
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x3022f723
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x3022f792
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x3022f79b
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x3022f714
jmp 0x3022f79d
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x3022f836
cmp dword [ebp - 0x6c], edi
je 0x3022f807
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x3022f7fc
call fcn.3022dc1c
mov dword [eax], 9
call fcn.3022dc25
mov dword [eax], esi
jmp 0x3022f831
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x3022f7f1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x3022f79d
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x3022f79d
push dword [ebp - 0x6c]
call fcn.3022dc2e
pop ecx
jmp 0x3022f831
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x3022f81f
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x3022f81f
xor eax, eax
jmp 0x3022f839
call fcn.3022dc1c
mov dword [eax], 0x1c
call fcn.3022dc25
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x3022f839
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.3022c9c7
add ebp, 0x3a0
leave
ret
Function at 0x3022fc49
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x302a3bc0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x302a4570]
je 0x3022fc7e
inc eax
cmp eax, 0x13
jb 0x3022fc6f
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x302a4570]
jne 0x3022fda4
mov eax, dword [0x30378cbc]
cmp eax, 1
je 0x3022fd7c
cmp eax, edx
jne 0x3022fcae
cmp dword [0x302a400c], 1
je 0x3022fd7c
cmp ecx, 0xfc
je 0x3022fda4
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x3022fce4
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.3022bdd0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.3022ba80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x3022fd18
mov eax, edi
push eax
call fcn.3022ba80
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x30235540
push edi
call fcn.3022bbe0
add esp, 0x10
push edi
call fcn.3022ba80
push dword [esi + 0x302a4574]
mov ebx, eax
call fcn.3022ba80
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.3022bf60
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.3022bdd0
push edi
push ebx
call fcn.3022bde0
push 0x302706d8
push ebx
call fcn.3022bde0
push dword [esi + 0x302a4574]
push ebx
call fcn.3022bde0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.300e6c17
add esp, 0x2c
jmp 0x3022fda4
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x302a4574]
push dword [esi]
call fcn.3022ba80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.3022c9c7
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret

Function at 0x30230c10
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x302a3bc0]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.30230be0
mov eax, 0x30000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.3022b3a0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x30230c72
cmp dword [ebp - 0x1c], 5
jb 0x30230c8a
jmp 0x30230c86
cmp dword [ebp - 0x10], 1
jne 0x30230c8a
cmp dword [ebp - 0x1c], 4
ja 0x30230c86
jne 0x30230c8a
cmp dword [ebp - 0x18], 0
jbe 0x30230c8a
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x30270f4c
call fcn.3007819c
test eax, eax
jge 0x30230cab
mov byte [0x302a5508], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.3022c9c7
add ebp, 0x78
leave
ret