joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1025c1e
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x102c22c]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, 0x80000000
push esi
push 0
push 0
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [ebp - 0x420], eax
jne 0x1025c71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100a460
call fcn.01015c5a
pop ecx
pop ecx
or edi, 0xffffffff
jmp 0x1025e2b
push ebx
lea eax, [ebp - 0x42c]
push eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 2
push edi
mov edi, dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldW]
call edi
test eax, eax
jne 0x1025cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100a438
call fcn.01015c5a
pop ecx
pop ecx
or edi, 0xffffffff
jmp 0x1025e1e
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [ebp + 0x14]
cmp esi, 1
mov dword [ebp - 0x424], eax
jne 0x1025d07
xor edi, edi
inc edi
test eax, eax
jne 0x1025cfb
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x100a410
call fcn.01015c5a
add esp, 0xc
jmp 0x1025e09
push 0x100a3ec
call fcn.01015c5a
jmp 0x1025d49
test eax, eax
jne 0x1025d22
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x100a3c0
jmp 0x1025cee
lea ecx, [ebp - 0x448]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1025d4f
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100a394
call fcn.01015c5a
pop ecx
pop ecx
jmp 0x1025e09
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x42c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push 3
push dword [ebp - 0x428]
call edi
test eax, eax
je 0x1025db0
lea esi, [esi + esi*2]
shl esi, 5
lea eax, [esi + 0x102c28c]
push eax
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
jne 0x1025db0
lea eax, [ebp - 0x41c]
push eax
push 4
push dword [ebp - 0x428]
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetIntField]
test eax, eax
jne 0x1025db5
or edi, 0xffffffff
jmp 0x1025e09
push 1
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 1
push dword [ebp + 0x14]
call fcn.01025374
mov edi, eax
cmp edi, 1
jne 0x1025dde
lea eax, [esi + 0x102c296]
jmp 0x1025de8
test edi, edi
jne 0x1025e09
lea eax, [esi + 0x102c2be]
push dword [ebp - 0x41c]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
push 0x100a350
call fcn.01015c5a
add esp, 0x14
cmp dword [ebp - 0x424], 0
je 0x1025e1e
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0101439a
leave
ret 0x10
Function at 0x102767e
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, edx
not eax
je 0x1027694
push esi
movsx esi, byte [ecx]
rol eax, 3
xor eax, esi
inc ecx
dec edx
jne 0x1027687
pop esi
ret

Function at 0x1027b00
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov edi, 0x100aeb8
push dword [ebp + 8]
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x1027b40
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0x100af04
jmp 0x1027b72
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x1027b7c
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0x100aec0
call fcn.01015c5a
add esp, 0x10
jmp 0x1027b98
cmp dword [ebp + 8], 4
je 0x1027b98
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0x100af48
call fcn.01015c5a
add esp, 0xc
push 0xd
pop esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
call fcn.01027ae5
pop edi
mov eax, esi
pop esi
leave
ret 0x18

Function at 0x1027bb0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
mov ebx, 0x100aeb8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 4]
je 0x1027bf9
push edi
push eax
push edi
push 2
push dword [ebp + 0x10]
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, edi
je 0x1027c1d
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push 0x100afd0
jmp 0x1027c44
push eax
push 2
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
je 0x1027c1d
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push 0x100af04
jmp 0x1027c44
push 4
lea eax, [ebp + 0x18]
push eax
push 4
push edi
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, edi
je 0x1027c4c
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push 0x100af8c
call fcn.01015c5a
add esp, 0x10
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.01027ae5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0x1027c65
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x100b010
call fcn.010145b0
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x1000000], 0x5a4d
jne 0x1027cb8
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1027cb8
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1027cd0
cmp ecx, 0x20b
je 0x1027cbd
mov dword [ebp - 0x1c], ebx
jmp 0x1027ce4
cmp dword [eax + 0x84], 0xe
jbe 0x1027cb8
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x1027cde
cmp dword [eax + 0x74], 0xe
jbe 0x1027cb8
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x108f9c0], edi
mov dword [0x108f9c4], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x102deb8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x102deb4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x108f9c8], eax
call fcn.01128000
cmp dword [0x102c6c0], ebx
jne 0x1027d41
push 0x1028098
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01028081
push 0x1001594
push 0x1001590
call sub.msvcrt.dll__initterm
mov eax, dword [0x102deb0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x102deac]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x100158c
push 0x1001584
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x1027dcc
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1027dac
cmp cl, 0x22
jne 0x1027d9d
cmp byte [eax], 0x22
jne 0x1027db5
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1027dc0
cmp cl, 0x20
jbe 0x1027db1
test byte [ebp - 0x54], 1
je 0x1027dd7
movzx ecx, word [ebp - 0x50]
jmp 0x1027dda
cmp byte [eax], 0x20
jbe 0x1027db5
inc eax
mov dword [ebp - 0x20], eax
jmp 0x1027dcc
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.010136b4
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1027df8
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x1027e34
mov eax, esi
jmp 0x1027e48
call fcn.010145eb
ret

Function at 0x1028451
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x102845f
sub eax, ecx
mov ecx, eax
not eax
je 0x102847a
movsx edx, byte [esi]
rol eax, 3
xor eax, edx
inc esi
dec ecx
jne 0x102846e
pop esi
pop ebp
ret 4
Function at 0x10284d9
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x401e70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40e03c]
sub esp, 4
test ebx, ebx
je 0x401ebb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401eb4
test esi, esi
je 0x401eb4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e90
mov dword [esp], 0x40e044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4020a0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4020f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4021c8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40212e
cmp eax, 4
jne 0x402150
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40213e
cmp edx, 4
je 0x40213e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004020a0
Function at 0x100bb0c8
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0xaf104
jmp fcn.10001058

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x67c26f81
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4ec22063
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7ac213c2
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5d544e56
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x180884a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x18018c0
call fcn.01808a24
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1808885
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1808885
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x180889d
cmp eax, 0x20b
je 0x180888a
mov dword [ebp - 0x1c], edi
jmp 0x18088b1
cmp dword [ecx + 0x84], 0xe
jbe 0x1808885
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x18088ab
cmp dword [ecx + 0x74], 0xe
jbe 0x1808885
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1817a10], 0xffffffff
or dword [0x1817a14], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1812b70]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1812b6c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1817a18], eax
call fcn.01808aa4
cmp dword [0x18122f0], edi
jne 0x180890c
push fcn.01808aa4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01808a8d
push 0x180a010
push 0x180a00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1812b68]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1812b64]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x180a008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.018063b5
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1808983
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x18089b8
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01808a5f
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x32324855
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x3d5a4dda
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100153a
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001cc0
call fcn.010016c4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1003398
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10012f5
cmp eax, esi
jne 0x10012e8
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10012f8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10012cf
xor esi, esi
inc esi
mov eax, dword [0x1003394]
cmp eax, esi
jne 0x100130b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100133a
mov eax, dword [0x1003394]
test eax, eax
jne 0x1001334
mov dword [0x1003394], esi
push 0x10010f0
push 0x10010e4
call fcn.01001231
pop ecx
pop ecx
test eax, eax
je 0x100133a
jmp 0x100145e
mov dword [0x100303c], esi
mov eax, dword [0x1003394]
cmp eax, esi
jne 0x100135e
push 0x10010e0
push 0x10010d8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003394], 2
cmp dword [ebp - 0x20], ebx
jne 0x100136b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100339c], ebx
je 0x100138c
push 0x100339c
call fcn.01001639
pop ecx
test eax, eax
je 0x100138c
push ebx
push 2
push ebx
call dword [0x100339c]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100145e
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10013f6
cmp cx, bx
je 0x10013b1
cmp dword [ebp - 0x1c], ebx
jne 0x10013f6
movzx ecx, word [eax]
cmp cx, bx
je 0x10013c6
cmp cx, 0x20
ja 0x10013c6
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10013b1
test byte [ebp - 0x40], 1
je 0x10013d2
movzx ecx, word [ebp - 0x3c]
jmp 0x10013d5
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1003038], eax
cmp dword [0x100302c], ebx
jne 0x100143b
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1001407
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100139b
cmp dword [0x100303c], ebx
jne 0x1001449
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003038]
jmp 0x100146a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001709
ret
call fcn.01001811
jmp 0x1001292
Function at 0x30001450
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
cmp word [ecx], 0x5a4d
jne 0x3001de98
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x3001de98
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
ret
xor eax, eax
ret

Function at 0x3000163c
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x30050f00
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x3000168d
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x3004f9b0], eax
mov ax, word [ebp - 0x30]
mov word [0x3004f9b4], ax
mov eax, dword [ebp - 0x18]
mov dword [0x3004f9b8], eax
mov eax, dword [ebp - 0x40]
mov dword [0x3004f9bc], eax
mov eax, esi
pop esi
leave
ret

Function at 0x30003498
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push edi
push 0x30002614
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x3001d96a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30003634
push edi
call esi
push 0x30003628
push edi
mov dword [0x3004f804], eax
call esi
push 0x3000361c
push edi
mov dword [0x3004f808], eax
call esi
push 0x30003614
push edi
mov dword [0x3004f80c], eax
call esi
cmp dword [0x3004f804], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x3004f810], eax
jne 0x3001d973
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x3004f808], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x3004f804], 0x3000134e
mov dword [0x3004f80c], esi
mov dword [0x3004f810], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x30053ba4], eax
je 0x3000360e
push dword [0x3004f808]
push eax
call esi
test eax, eax
je 0x3000360e
call fcn.30003b94
push dword [0x3004f804]
call fcn.30008e63
push dword [0x3004f808]
mov dword [0x3004f804], eax
call fcn.30008e63
push dword [0x3004f80c]
mov dword [0x3004f808], eax
call fcn.30008e63
push dword [0x3004f810]
mov dword [0x3004f80c], eax
call fcn.30008e63
add esp, 0x10
mov dword [0x3004f810], eax
call fcn.30002b51
test eax, eax
je 0x30003609
push 0x30028a6b
push dword [0x3004f804]
call fcn.3000f831
pop ecx
call eax
cmp eax, 0xffffffff
mov dword [0x30053ba0], eax
je 0x30003609
push 0x214
push 1
call fcn.30003acf
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x30003609
push esi
push dword [0x30053ba0]
push dword [0x3004f80c]
call fcn.3000f831
pop ecx
call eax
test eax, eax
je 0x30003609
push 0
push esi
call fcn.3000363d
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
pop esi
pop edi
ret
test eax, eax
je 0x300034fc
jmp 0x30003520
call fcn.30028a2a
xor eax, eax
jmp 0x300035f9
call fcn.30028a2a
xor eax, eax
pop edi
ret
cmp dword [0x3004f808], 0
je 0x300034fc
cmp dword [0x3004f80c], 0
jne 0x300035fc
jmp 0x300034fc
Function at 0x30003c5a
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x3004f800]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x30003d04
call edi
mov esi, eax
cmp esi, ebx
je 0x3001d6a8
mov dword [0x3004f800], 1
cmp esi, ebx
je 0x3001d6c9
cmp word [esi], bx
mov eax, esi
je 0x30003cad
add eax, ebp
cmp word [eax], bx
jne 0x30003c9f
add eax, ebp
cmp word [eax], bx
jne 0x30003c9f
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x30003cf4
push ebp
call fcn.30003d0e
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x30003cf4
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x3001d6dc
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
je 0x30003c90
jmp 0x3001d6ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x3001d6bf
mov eax, ebp
mov dword [0x3004f800], eax
jmp 0x30003d04
mov eax, dword [0x3004f800]
jmp 0x30003d04
call edi
mov esi, eax
cmp esi, ebx
jne 0x30003c98
xor eax, eax
jmp 0x30003cfd
push dword [esp + 0x10]
call fcn.30012ff9
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x30003cf0
cmp eax, ebp
je 0x3001d6f7
cmp eax, ebx
jne 0x3001d6d5
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x3001d6d5
cmp byte [esi], bl
je 0x3001d711
inc eax
cmp byte [eax], bl
jne 0x3001d707
inc eax
cmp byte [eax], bl
jne 0x3001d707
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.30003d0e
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x3001d72c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x3001d6d5
push ebp
push esi
push edi
call fcn.30008ba2
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x30003cfd

Function at 0x30003e2c
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x30003e6a
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x3001de9b
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jae 0x3001de9b
pop edi
pop esi
pop ebx
ret
xor eax, eax
jmp 0x30003e66
add edx, 1
add eax, 0x28
cmp edx, esi
jae 0x30003e6a
jmp 0x30003e4e