joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30001050
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push rbx
push rdi
movabs rax, 0x48
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov qword [rsp + 0x30], 0
xor edi, edi
cmp dword [0x30089a4c], edi
je 0x30001086
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x30], rax
jmp 0x30001102
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rbx, rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0x300010c4
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add edi, 1
lea edx, [rdi + rdi]
lea rcx, [rsp + 0x30]
call fcn.30021290
test eax, eax
je 0x300011c9
mov dword [rsp + 0x28], edi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsp + 0x30]
mov cx, word [rax]
cmp cx, 0x22
jne 0x30001121
add rax, 2
mov cx, word [rax]
cmp cx, 0x22
je 0x3000113b
test cx, cx
jne 0x3000110b
jmp 0x30001149
cmp cx, 0x20
jbe 0x30001141
add rax, 2
cmp word [rax], 0x20
ja 0x30001127
jmp 0x30001141
cmp cx, 0x20
ja 0x30001149
add rax, 2
mov cx, word [rax]
test cx, cx
jne 0x30001135
mov dword [0x30089c58], 0
mov rcx, rax
call fcn.30003a10
mov ebx, eax
test edi, edi
je 0x3000116b
mov rcx, qword [rsp + 0x30]
call fcn.300214c0
mov eax, ebx
and eax, 0x60
jne 0x300011cf
mov eax, ebx
and al, 8
je 0x3000117f
mov eax, 8
jmp 0x300011cf
mov eax, ebx
and eax, 0x2ee
je 0x300011c9
xor edx, edx
mov ecx, edx
mov r8d, 1
shl r8d, cl
mov eax, r8d
and eax, 0x2ee
je 0x300011b2
mov eax, r8d
and eax, ebx
je 0x300011b2
mov eax, ebx
sub eax, r8d
and eax, 0x2ee
jne 0x300011c9
add edx, 1
cmp edx, 0x20
jb 0x3000118a
mov eax, ebx
and al, 4
je 0x300011cd
mov eax, ebx
and eax, 0x100
jne 0x300011cd
xor eax, eax
jmp 0x300011cf
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x300011d8
Capabilities:
Read file via mapping

Disassembly:
movabs rax, 0x38
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov ecx, dword [0x30089c58]
mov qword [0x30085a98], rcx
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 6
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov qword [0x30085a90], rdx
test rdx, rdx
je 0x30001440
cmp dword [rdx], 0x1c6c
jne 0x30001440
xor ecx, ecx
mov eax, dword [rdx + 0x34]
or rcx, rax
mov eax, dword [rdx + 0x38]
shl rax, 0x20
or rcx, rax
je 0x30001440
xor ecx, ecx
mov eax, dword [rdx + 0x1c]
or rcx, rax
mov eax, dword [rdx + 0x20]
shl rax, 0x20
or rcx, rax
je 0x30001440
xor ecx, ecx
mov eax, dword [rdx + 0x2c]
or rcx, rax
mov eax, dword [rdx + 0x30]
shl rax, 0x20
or rcx, rax
je 0x30001440
cmp dword [0x30089c68], 0
jne 0x30001299
xor ecx, ecx
mov eax, dword [rdx + 0x3c]
or rcx, rax
mov eax, dword [rdx + 0x40]
shl rax, 0x20
or rcx, rax
je 0x30001440
cmp word [rdx + 0xd2], 0
jne 0x30001440
cmp word [rdx + 0x2da], 0
jne 0x30001440
cmp word [rdx + 0x4e2], 0
jne 0x30001440
cmp word [rdx + 0x6ea], 0
jne 0x30001440
cmp word [rdx + 0x8f2], 0
jne 0x30001440
cmp word [rdx + 0xafa], 0
jne 0x30001440
cmp word [rdx + 0xb6a], 0
jne 0x30001440
cmp word [rdx + 0xd72], 0
jne 0x30001440
cmp word [rdx + 0xde2], 0
jne 0x30001440
cmp word [rdx + 0xe52], 0
jne 0x30001440
cmp word [rdx + 0x1432], 0
jne 0x30001440
cmp word [rdx + 0x1c32], 0
jne 0x30001440
cmp byte [rdx + 0xf57], 0
jne 0x30001440
cmp byte [rdx + 0x105b], 0
jne 0x30001440
cmp byte [rdx + 0x115f], 0
jne 0x30001440
cmp byte [rdx + 0x122b], 0
jne 0x30001440
cmp byte [rdx + 0x1c6b], 0
jne 0x30001440
mov al, byte [rdx + 0x44]
and al, 0x20
mov eax, dword [0x300899f4]
mov ecx, 1
cmovne eax, ecx
mov dword [0x300899f4], eax
mov eax, dword [rdx + 0x44]
and eax, 0x8000
mov eax, dword [0x30089c78]
cmovne eax, ecx
mov dword [0x30089c78], eax
mov eax, dword [rdx + 0x44]
and eax, 0x20000
mov eax, dword [0x30089c80]
cmovne eax, ecx
mov dword [0x30089c80], eax
mov eax, dword [rdx + 0x44]
and eax, 0x2000
mov eax, dword [0x30089c6c]
cmovne eax, ecx
mov dword [0x30089c6c], eax
mov eax, dword [rdx + 0x44]
and eax, 0x4000
mov eax, dword [0x30089c70]
cmovne eax, ecx
mov dword [0x30089c70], eax
mov eax, dword [rdx + 0x44]
and eax, 0x40000
mov eax, dword [0x30089c84]
cmovne eax, ecx
mov dword [0x30089c84], eax
mov eax, dword [rdx + 0x44]
and eax, 0x80000
mov eax, dword [0x30089c88]
cmovne eax, ecx
mov dword [0x30089c88], eax
mov eax, dword [rdx + 0x44]
and eax, 0x100000
mov eax, dword [0x30089c8c]
cmovne eax, ecx
mov dword [0x30089c8c], eax
mov eax, ecx
jmp 0x30001442
xor eax, eax
add rsp, 0x38
ret
Function at 0x30005584
Capabilities:
Identify system language via api

Disassembly:
push rbx
movabs rax, 0x40
call sub.KERNEL32.dll___chkstk
sub rsp, rax
movzx ebx, cx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x30089a08], eax
call qword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x30089a0c], eax
test bx, bx
je 0x300055c4
movzx ecx, bx
call fcn.30005440
test eax, eax
jne 0x3000561c
call fcn.30005530
mov bx, ax
movzx ecx, bx
call fcn.30005440
test eax, eax
jne 0x3000561c
cmp dword [0x30089a48], eax
je 0x300055f5
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov bx, ax
movzx ecx, bx
call fcn.30005440
test eax, eax
jne 0x3000561c
mov bx, word [0x30089a08]
movzx ecx, bx
call fcn.30005440
test eax, eax
jne 0x3000561c
mov bx, 0x409
movzx ecx, bx
call fcn.30005440
test eax, eax
je 0x300056c1
mov eax, dword [0x30089a08]
cmp bx, ax
je 0x3000562a
movzx eax, bx
mov dword [0x3008a0b4], eax
mov r9d, 0xc
lea r8, [rsp + 0x28]
mov edx, 0x90
mov rcx, qword [0x30089a38]
call fcn.3000b03c
test eax, eax
je 0x30005675
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.30025b90
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x30005675
mov eax, ecx
shr rax, 0x10
test ax, ax
jne 0x30005675
mov bx, cx
mov word [0x30089a18], bx
movzx ecx, bx
call fcn.3002f408
mov byte [0x30089a14], al
movzx ecx, word [0x30089a18]
call fcn.3002f3dc
mov dword [0x30089a10], eax
movabs rdx, 0x77
mov rcx, qword [0x30089a38]
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [0x30085490], rax
mov eax, 1
jmp 0x300056c3
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x300058d8
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
movabs rax, 0x608
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov r12, rdx
mov rsi, rcx
mov al, byte [0x30037f52]
mov byte [rsp + 0x40], al
mov dword [rsp + 0x70], 0
lea rdi, [rsp + 0x74]
xor eax, eax
movabs rcx, 0x6c
rep stosb byte [rdi], al
mov edx, 0xfffffff8
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rbx, rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
movabs rdx, 0xfffffffffffffffe
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [r12 + 0x20], 0
je 0x30005a8a
lea rcx, str.dwprivacy.hta
call fcn.30009ce0
test eax, eax
je 0x30005a8a
mov r9d, dword [0x3008a0b4]
lea r8, [0x30038058]
movabs rdx, 0x19
lea rcx, [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea rcx, [rsp + 0xe0]
call fcn.300053dc
test eax, eax
je 0x30005aec
lea rdi, [0x30038048]
mov rcx, rdi
call fcn.300219f0
mov ebx, eax
lea rcx, [rsp + 0xe0]
call fcn.300219f0
lea eax, [rbx + rax + 1]
cmp eax, 0x104
jg 0x30005aec
mov r8d, 0x104
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.3000af70
mov dword [rsp + 0x70], 0x70
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0xa0], 0xa
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x30005aec
mov rax, qword [r12 + 0x30]
lea rdx, [rsp + 0x40]
test rax, rax
cmovne rdx, rax
mov rax, qword [r12 + 0xa8]
lea rcx, [rsp + 0x40]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r9d, dword [0x3008a0b4]
lea r8, str.http:__watson.microsoft.com_dw_dcp.asp_CLCID_dEXENAME_sBRAND_s
movabs rdx, 0x401
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea rcx, [rsp + 0x1f0]
call fcn.3000f4b8
add rsp, 0x608
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x30008268
Capabilities:
Check os version
Terminate process

Disassembly:
push rdi
movabs rax, 0xc0
call sub.KERNEL32.dll___chkstk
sub rsp, rax
lea rdi, [rsp + 0x24]
xor eax, eax
movabs rcx, 0x90
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x300082fb
mov eax, dword [rsp + 0x24]
cmp eax, 4
jae 0x300082bb
mov ecx, 1
jmp 0x30008304
mov dword [0x30089a4c], 1
mov dword [0x3008a0b8], 1
cmp eax, 5
jb 0x30008328
mov dword [0x30089a40], 1
mov dword [0x30089a48], 1
cmp dword [rsp + 0x28], 1
jb 0x30008328
mov dword [0x30089a44], 1
jmp 0x30008328
mov ecx, 1
cmp eax, ecx
je 0x3000830a
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x30089a40]
cmp dword [rsp + 0x28], 0
cmova eax, ecx
mov dword [0x30089a40], eax
mov dword [0x30089a4c], 0
add rsp, 0xc0
pop rdi
ret
Function at 0x3000893c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
movabs rax, 0x20
call sub.KERNEL32.dll___chkstk
sub rsp, rax
cmp dword [0x3008a020], 0
je 0x3000896b
xor eax, eax
cmp qword [0x3008a008], 0
setne al
jmp 0x30008abb
call fcn.300088ec
mov dword [0x3008a024], eax
lea rcx, str.USER32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rbx, rbx
je 0x30008a62
lea rdx, [0x30038478]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x30089fe8], rax
test rax, rax
je 0x30008a62
lea rdx, str.MonitorFromWindow
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x30089ff0], rax
test rax, rax
je 0x30008a62
lea rdx, str.MonitorFromRect
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x30089ff8], rax
test rax, rax
je 0x30008a62
lea rdx, str.MonitorFromPoint
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x3008a000], rax
test rax, rax
je 0x30008a62
lea rdx, str.EnumDisplayMonitors
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x3008a010], rax
test rax, rax
je 0x30008a62
lea rdx, str.GetMonitorInfoA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x3008a008], rax
test rax, rax
je 0x30008a62
lea rdx, str.EnumDisplayDevicesA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x3008a018], rax
test rax, rax
je 0x30008a62
mov eax, 1
jmp 0x30008ab1
mov qword [0x30089fe8], 0
mov qword [0x30089ff0], 0
mov qword [0x30089ff8], 0
mov qword [0x3008a000], 0
mov qword [0x3008a008], 0
mov qword [0x3008a010], 0
mov qword [0x3008a018], 0
xor eax, eax
mov dword [0x3008a020], 1
add rsp, 0x20
pop rbx
ret

Function at 0x30009018
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
movabs rax, 0x48
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r12, rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x300090cd
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x34], eax
jne 0x300090cd
mov ecx, dword [rsp + 0x30]
test ecx, ecx
jne 0x30009083
mov qword [rbx], 0
mov dword [rdi], ecx
jmp 0x300090e4
mov edx, 0x106
call fcn.30021110
mov qword [rbx], rax
test rax, rax
je 0x300090cd
mov eax, dword [rsp + 0x30]
mov dword [rdi], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x300090cd
mov eax, dword [rsp + 0x30]
cmp eax, dword [rdi]
je 0x300090d1
xor eax, eax
jmp 0x300090e9
cmp dword [rsp + 0x34], 1
jne 0x300090e4
add eax, 0xffffffff
mov ecx, eax
mov rax, qword [rbx]
mov byte [rcx + rax], 0
mov eax, 1
add rsp, 0x48
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x30009748
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
movabs rax, 0x30
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rbx, rcx
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x300097f2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x18], eax
cmp eax, 0xffffffff
je 0x300097e2
test eax, eax
je 0x300097e2
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 8], rax
test rax, rax
je 0x300097e2
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x300097fb
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0xffffffffffffffff
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
jmp 0x300097f4

Function at 0x30009908
Capabilities:
Delete file

Disassembly:
push rbx
push rsi
push rdi
movabs rax, 0x50
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rbx, rcx
mov qword [rsp + 0x40], 0
xor edi, edi
test rbx, rbx
jne 0x3000993a
xor eax, eax
jmp 0x300099c8
mov rcx, rbx
cmp dword [0x30089a4c], 0
je 0x30009950
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
jmp 0x300099c6
call fcn.30021a10
lea esi, [rax + rax + 1]
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.30021290
test eax, eax
je 0x300099c6
lea edx, [rsi - 1]
movsxd rcx, edx
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, dword [0x30089a0c]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call fcn.300214c0
mov eax, edi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x30009a78
Capabilities:
Delete directory

Disassembly:
push rbx
push rsi
push rdi
movabs rax, 0x50
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rbx, rcx
mov qword [rsp + 0x40], 0
xor edi, edi
test rbx, rbx
jne 0x30009aaa
xor eax, eax
jmp 0x30009b38
mov rcx, rbx
cmp dword [0x30089a4c], 0
je 0x30009ac0
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
jmp 0x30009b36
call fcn.30021a10
lea esi, [rax + rax + 1]
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.30021290
test eax, eax
je 0x30009b36
lea edx, [rsi - 1]
movsxd rcx, edx
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, dword [0x30089a0c]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call fcn.300214c0
mov eax, edi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x30009ce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
movabs rax, 0x28
call sub.KERNEL32.dll___chkstk
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x30009d08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
movabs rax, 0x28
call sub.KERNEL32.dll___chkstk
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x30009d29
xor eax, eax
jmp 0x30009d2c
and eax, 0x10
add rsp, 0x28
ret

Function at 0x3000a0ec
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
movabs rax, 0x58
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rsi, rdx
mov r12, rcx
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rdi, 0xffffffffffffffff
jne 0x3000a172
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp eax, 0x20
je 0x3000a15d
cmp eax, 0x21
je 0x3000a15d
cmp eax, 0x36
jne 0x3000a1b4
add ebx, 1
cmp ebx, 5
jge 0x3000a1b4
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x3000a10e
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, r12
call fcn.300219f0
mov r8d, eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x58
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x3000a590
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
movabs rax, 0x50
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rdi, r9
mov esi, r8d
mov r12d, edx
mov rbx, rcx
cmp dword [0x30089a4c], 0
je 0x3000a5cb
call sub.VERSION.dll_GetFileVersionInfoW
jmp 0x3000a676
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, dword [0x30089a0c]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r13d, eax
add r13d, 1
mov edx, r13d
lea rcx, [rsp + 0x40]
call fcn.30021290
test eax, eax
je 0x3000a676
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, dword [0x30089a0c]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9, rdi
mov r8d, esi
mov edx, r12d
mov rcx, qword [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoA
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call fcn.300214c0
mov eax, ebx
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x3000a688
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
push r12
movabs rax, 0x48
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rsi, rdx
mov edi, ecx
xor ebx, ebx
cmp dword [0x30089a4c], ebx
je 0x3000a6b9
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x3000a70c
lea r12d, [rdi + rdi]
mov edx, r12d
lea rcx, [rsp + 0x30]
call fcn.30021290
test eax, eax
je 0x3000a70c
mov rdx, qword [rsp + 0x30]
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x3000a700
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call fcn.300214c0
mov eax, ebx
add rsp, 0x48
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x3000a71c
Capabilities:
Get file attributes

Disassembly:
push rbx
push rdi
movabs rax, 0x58
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rbx, rcx
cmp dword [0x30089a4c], 0
je 0x3000a749
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x3000a7e0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
add edi, 1
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.30021290
test eax, eax
je 0x3000a7e0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call fcn.300214c0
mov eax, ebx
add rsp, 0x58
pop rdi
pop rbx
ret

Function at 0x3000a7ec
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
movabs rax, 0x50
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rdi, rdx
mov rbx, rcx
cmp dword [0x30089a4c], 0
je 0x3000a81e
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x3000a8b8
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
add esi, 1
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.30021290
test eax, eax
je 0x3000a8b8
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call fcn.300214c0
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x3000b358
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
movabs rax, 0x58
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov r12, rdx
mov rsi, rcx
xor ebx, ebx
test r12, r12
je 0x3000b496
test rsi, rsi
je 0x3000b496
mov edx, 0x8000
lea rcx, [rsp + 0x48]
call fcn.30021290
test eax, eax
je 0x3000b496
mov rdi, qword [rsp + 0x48]
xor eax, eax
movabs rcx, 0x8000
rep stosb byte [rdi], al
mov r8d, 0x8000
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.3000b2d0
test eax, eax
je 0x3000b433
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call fcn.3000a3dc
mov rdi, rax
cmp rdi, 0xffffffffffffffff
jne 0x3000b443
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp eax, 0x20
je 0x3000b41b
cmp eax, 0x21
je 0x3000b41b
cmp eax, 0x36
jne 0x3000b433
add ebx, 1
cmp ebx, 5
jge 0x3000b42e
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0x32
jl 0x3000b3cd
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
call fcn.300214c0
mov eax, ebx
jmp 0x3000b498
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rsp + 0x48]
call fcn.300219f0
mov r8d, eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
jmp 0x3000b435
xor eax, eax
add rsp, 0x58
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x3000bf34
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
movabs rax, 0x40
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rdi, r9
mov rsi, r8
mov ebx, 1
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
movabs rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x3000bf8f
xor eax, eax
jmp 0x3000bfc6
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret