joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30020b10
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
dec eax
je 0x30020b95
dec eax
jne 0x30020bb3
mov eax, dword [esp + 8]
cmp eax, 6
jne 0x30020b51
mov esi, str.Windows_Vista
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 5
jne 0x30020b81
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x30020b6e
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x30020bb3
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x30020bb3
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x30020bac
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x30020bb3
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x30021390
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
dec eax
push 0x1c
not eax
lea ecx, [esp + 4]
lea edx, [esp + 8]
and eax, ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 8]
sub eax, 0x1c
neg eax
sbb eax, eax
not eax
and eax, ecx
add esp, 0x44
ret

Function at 0x30021550
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x64
cmp eax, 7
jl 0x300215a8
push esi
lea ecx, [esp + 4]
call fcn.3001f8f0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x30021572
call eax
jmp 0x30021578
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x3002158e
cmp eax, 0xffffffff
je 0x3002158e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test si, si
je 0x300215a1
push esi
call fcn.30020c00
add esp, 4
pop esi
add esp, 0x64
ret
xor eax, eax
pop esi
add esp, 0x64
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push eax
call fcn.30020c00
add esp, 4
add esp, 0x64
ret
Function at 0x30023bb0
Capabilities:
Create thread
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xf58]
test eax, eax
je 0x30023c20
mov eax, dword [edi]
call dword [eax + 0x11c]
test eax, eax
jne 0x30023bd9
mov dword [edi + 0x850], 1
pop edi
pop esi
ret 0xc
mov esi, dword [edi + 0xf58]
mov dword [esi + 0x18], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x120]
mov dword [esi + 0x1c], eax
mov dword [edi + 0xf58], 0
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x30021e50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x30023c1b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 0xc
push 0x20
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x30023c1b
mov eax, dword [esp + 0xc]
push eax
call fcn.30075310
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi], eax
call fcn.30075310
mov dl, byte [esp + 0x1c]
add esp, 8
mov dword [esi + 4], eax
mov byte [esi + 8], dl
call fcn.30020a60
mov byte [esi + 9], al
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x124]
mov dword [esi + 0x14], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x11c]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x120]
mov ecx, edi
mov dword [esi + 0x1c], eax
call fcn.30020fb0
test al, al
je 0x30023c98
mov ecx, dword [edi + 0xe68]
mov dword [esi + 0xc], ecx
jmp 0x30023c9f
mov dword [esi + 0xc], 0
mov edx, dword [edi]
push ebx
push ebp
mov ecx, edi
call dword [edx + 0x124]
mov ebx, eax
call fcn.30020a60
test al, al
mov ebp, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
je 0x30023ce5
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
jmp 0x30023d0c
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
pop ebp
mov dword [esi + 0x10], eax
pop ebx
je 0x30023c1b
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x30023bf9
mov dword [edi + 0xf58], esi
mov dword [edi + 0x850], 1
pop edi
pop esi
ret 0xc

Function at 0x30024bd0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
test esi, esi
mov ecx, esi
je 0x30024c03
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x30024c03
cmp eax, 0x104
jge 0x30024c03
inc eax
test ecx, ecx
jne 0x30024bf0
add eax, esi
pop esi
ret
Function at 0x30026510
Capabilities:
Get file attributes

Disassembly:
push ecx
mov eax, dword [ecx + 0x40]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x30026529
mov ecx, dword [esp + 0x10]
push ecx
call eax
jmp 0x30026545
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.300263a0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test bl, 1
mov esi, eax
je 0x30026559
mov eax, dword [esp + 0x10]
push eax
call fcn.30208320
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x30026570
Capabilities:
Create directory

Disassembly:
push ecx
mov eax, dword [ecx + 0xc]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x3002658a
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call eax
jmp 0x300265a8
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.300263a0
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test bl, 1
mov esi, eax
je 0x300265bc
mov eax, dword [esp + 0x10]
push eax
call fcn.30208320
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x300265d0
Capabilities:
Delete file

Disassembly:
push ecx
mov eax, dword [ecx + 0x18]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x300265e9
mov ecx, dword [esp + 0x10]
push ecx
call eax
jmp 0x30026605
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.300263a0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, 1
mov esi, eax
je 0x30026619
mov eax, dword [esp + 0x10]
push eax
call fcn.30208320
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x30026730
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push 0x8000000
push 3
push 1
push SysReAllocString
push eax
mov byte [esp + 0x1b], 0
call fcn.30026490
mov ebp, eax
cmp ebp, 0xffffffff
je 0x300267f5
push esi
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
push ecx
mov edi, eax
call fcn.30208320
add esp, 4
test edi, edi
je 0x30026785
push edi
call fcn.3007a1f0
add esp, 4
jmp 0x30026787
xor eax, eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
test eax, eax
mov dword [esi], eax
mov dword [esi + 4], ecx
je 0x300267ec
push 0
lea edx, [esp + 0x18]
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x300267d4
mov eax, dword [esi + 4]
cmp eax, dword [esp + 0x14]
jne 0x300267d4
push ebp
mov byte [esp + 0x13], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
pop ecx
ret 8
mov ecx, dword [esi]
push ecx
call fcn.30208320
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, byte [esp + 7]
pop ebp
pop ecx
ret 8
Function at 0x30026c80
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push esi
mov esi, ecx
mov eax, dword [esi + 0xa0]
test eax, eax
push edi
jne 0x30026d8e
mov eax, dword [esi + 0x80]
test eax, eax
je 0x30026cde
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x1a
push 0
call eax
cmp eax, 0x80070057
je 0x30026d5f
push 0x30293eb0
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.30026410
mov dword [esi + 0xa0], eax
jmp 0x30026d5f
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30026d5f
mov byte [esp + 0x10], al
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
stosw word es:[edi], ax
push 0
push 0
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push str.AppData
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x30026d54
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.30026870
mov dword [esi + 0xa0], eax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esi + 0xa0]
test edi, edi
je 0x30026d8e
push edi
call fcn.3028d780
add esp, 4
test eax, eax
jbe 0x30026d8e
mov cx, word [edi + eax*2 - 2]
cmp cx, 0x2f
je 0x30026d87
cmp cx, 0x5c
jne 0x30026d8e
mov word [edi + eax*2 - 2], 0
mov eax, dword [esi + 0xa0]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x30026fc0
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x94]
test eax, eax
push esi
push edi
je 0x30027019
mov ecx, dword [ebx + 0x98]
test ecx, ecx
je 0x30027019
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push ebp
call eax
mov esi, eax
test esi, esi
je 0x30027075
push esi
call fcn.3007a1f0
mov edi, eax
add esp, 4
test edi, edi
je 0x30027075
push edi
push esi
push 0
push ebp
call dword [ebx + 0x98]
test eax, eax
je 0x30027075
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x1c]
call fcn.300263a0
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x3002706c
push esi
call fcn.3007a1f0
mov edi, eax
add esp, 4
test edi, edi
je 0x3002706c
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x3002706c
push ebx
call fcn.30208320
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push ebx
call fcn.30208320
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x30027190
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
push eax
mov esi, ecx
mov dword [esp + 0xc], 0
call fcn.30027120
test eax, eax
mov edi, dword [esp + 0x18]
je 0x300271eb
push 0x10000000
push 2
push 1
push 0x40000000
push eax
mov ecx, esi
call fcn.30026490
mov esi, eax
test esi, esi
je 0x300271eb
cmp esi, 0xffffffff
je 0x300271eb
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 8]
xor eax, eax
cmp esi, edi
sete al
pop edi
pop esi
dec eax
and eax, 3
pop ecx
ret 0xc

Function at 0x30027200
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
push edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x17], 0
xor ebp, ebp
xor esi, esi
call fcn.300263a0
mov eax, dword [eax]
push eax
call fcn.3007c870
mov bl, al
mov eax, dword [esp + 0x20]
push eax
call fcn.30208320
add esp, 8
test bl, bl
je 0x300272f8
push 0x30293eb0
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.30026410
mov ebp, eax
test ebp, ebp
je 0x300272f8
mov ax, word [ebp]
test ax, ax
mov ecx, ebp
je 0x30027283
cmp ax, 0x41
jb 0x30027277
cmp ax, 0x5a
ja 0x30027277
add word [ecx], 0x20
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x30027267
push 0x30293eb0
push str.MacromediaMutexGamma
mov ecx, edi
call fcn.30026410
mov esi, eax
test esi, esi
je 0x300272f8
push ebp
push esi
mov ecx, edi
call fcn.30026410
push esi
mov edi, eax
call fcn.30208320
add esp, 4
push edi
lea ecx, [esp + 0x20]
mov esi, edi
call fcn.300263a0
mov eax, dword [eax]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esp + 0x1c]
push ecx
mov edi, eax
call fcn.30208320
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x300272e8
mov byte [esp + 0x13], 1
test edi, edi
je 0x300272f8
cmp edi, 0xffffffff
je 0x300272f8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.30208320
push ebp
call fcn.30208320
mov al, byte [esp + 0x1b]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x30027430
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10004
call fcn.3028d660
mov eax, dword [esp + 0x10008]
push ebx
push esi
push edi
push 0
push 0x8000000
push 3
push 0
push 1
push SysReAllocString
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
lea edx, [esp + 0x1c]
mov esi, eax
push edx
push esi
mov dword [esp + 0x20], 0x10000
call ebx
test eax, eax
je 0x300274be
mov eax, dword [esp + 0xc]
test eax, eax
je 0x300274be
push eax
lea eax, [esp + 0x14]
push eax
push edi
call fcn.300cb940
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
lea edx, [esp + 0x1c]
push edx
push esi
mov dword [esp + 0x20], 0x10000
call ebx
test eax, eax
jne 0x30027487
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x10004
ret 4
Function at 0x300274e0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x300275bc
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x30027556
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + 0x303000f8]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x303000f8]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x303000f8]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + 0x303000f8]
mov byte [ecx], dl
jmp 0x300275a9
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x30027568
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + 0x303000f8]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x303000f8]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x30027596
mov edx, 0x3d
jmp 0x300275a3
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x303000f8]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x30027500
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret 0xc
Function at 0x300285d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x30028641
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x30028641
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x30028641
lea ecx, [esp + 0x20c]
push ecx
push 0x104
call dword [eax + 0x54]
test eax, eax
jbe 0x30028693
mov edx, dword [esi + 4]
lea eax, [esp + 4]
push eax
push 0
push str.flash
lea ecx, [esp + 0x218]
push ecx
call dword [edx + 0x58]
test eax, eax
jbe 0x30028693
mov ecx, dword [esp + 0x418]
lea edx, [esp + 4]
push edx
call fcn.30073390
mov al, 1
pop esi
add esp, 0x410
ret 4
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x30028693
lea ecx, [esp + 0x20c]
push ecx
push 0
push 0x30295be0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jbe 0x30028693
mov ecx, dword [esp + 0x418]
lea eax, [esp + 0x20c]
push eax
call fcn.300732f0
mov al, 1
pop esi
add esp, 0x410
ret 4
xor al, al
pop esi
add esp, 0x410
ret 4

Function at 0x300286d0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x230
push ebx
xor bl, bl
test eax, eax
je 0x30028715
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x30028715
push 0x105
lea ecx, [esp + 8]
push ecx
call dword [eax + 0x30]
test eax, eax
je 0x30028746
mov ecx, dword [esp + 0x238]
lea edx, [esp + 4]
push edx
call fcn.30073390
mov al, 1
pop ebx
add esp, 0x230
ret 4
push 0x105
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x30028746
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x23c]
call fcn.300732f0
mov al, 1
pop ebx
add esp, 0x230
ret 4
mov al, bl
pop ebx
add esp, 0x230
ret 4
Function at 0x30028830
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x6c]
push esi
xor eax, eax
mov dword [esp + 0xc], eax
push edi
mov esi, ecx
mov dword [esp + 0x14], eax
push ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
call fcn.30073250
push 0
lea ecx, [esp + 0x20]
call fcn.30073600
mov esi, dword [esi + 4]
test esi, esi
je 0x300288b7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x300288b7
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], 0x44
call fcn.30073410
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, ebx
call fcn.30073410
push eax
call dword [esi + 0x14]
jmp 0x300288fa
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], 0x44
call fcn.30073710
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, ebx
call fcn.30073710
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
test bl, bl
je 0x3002892b
mov eax, dword [esp + 0x78]
test eax, eax
jbe 0x30028917
mov edx, dword [esp + 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
lea ecx, [esp + 0x1c]
call fcn.300731a0
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x64
ret 8
Function at 0x30028bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
mov ecx, dword [esp + 0x10]
push eax
mov dword [edi], 0
mov edx, dword [esi + 0xc]
push ecx
push edx
lea ecx, [esp + 0x28]
xor bl, bl
call fcn.30027c70
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x30028c89
mov eax, dword [esi + 0xc]
test eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 4
je 0x30028c32
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x30028c32
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x30028c11
call fcn.30073410
jmp 0x30028c13
xor eax, eax
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x20]
push edx
push 0
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [ecx + 0x1c]
jmp 0x30028c60
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x30028c41
call fcn.30073710
jmp 0x30028c43
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x30028c7a
cmp dword [esp + 0x18], 4
jne 0x30028c7a
cmp dword [esp + 0x14], 4
jne 0x30028c7a
mov eax, dword [esp + 0x10]
mov dword [edi], eax
mov bl, 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x30028c89
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
ret 0x10
Function at 0x30028d50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov esi, ecx
xor edi, edi
push ebp
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], edi
call fcn.300263a0
mov eax, dword [eax]
push eax
call fcn.3007c870
mov bl, al
mov eax, dword [esp + 0x28]
push eax
call fcn.30208320
add esp, 8
test bl, bl
je 0x30028f1d
push ebp
mov ecx, esi
call fcn.30027080
mov edi, eax
test edi, edi
je 0x30028f1d
push edi
mov ecx, esi
call fcn.30026630
mov ebx, eax
test ebx, ebx
je 0x30028dc5
push ebx
mov ecx, esi
call fcn.300266a0
push ebx
call fcn.30208320
add esp, 4
push 0x10000000
push 2
push 1
push 0x40000000
push edi
mov ecx, esi
call fcn.30026490
mov ebx, eax
test ebx, ebx
je 0x30028f1d
cmp ebx, 0xffffffff
je 0x30028f1d
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.300275d0
test al, al
mov ebp, dword [esp + 0x10]
je 0x30028f04
cmp byte [ebp], 0x54
jne 0x30028f04
cmp byte [ebp + 1], 0x72
jne 0x30028f04
cmp byte [ebp + 2], 0x6f
jne 0x30028f04
cmp byte [ebp + 3], 0x79
jne 0x30028f04
mov ecx, dword [esp + 0x24]
mov eax, dword [ebp + 4]
lea ecx, [ecx + ecx*4]
shl ecx, 1
cmp eax, ecx
mov dword [esp + 0x34], eax
jae 0x30028f0c
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.30026330
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x30028e9a
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 4
call fcn.30027990
mov ebp, dword [esp + 0x10]
jmp 0x30028f0c
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
add edx, 0xfffffff8
push edx
add eax, 8
push eax
lea ecx, [esp + 0x3c]
push ecx
push ebp
call fcn.30128050
add esp, 0x10
test eax, eax
jne 0x30028ef5
push 2
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
push 0
lea edx, [esp + 0x28]
push edx
push eax
push ebp
push ebx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x34]
jne 0x30028ef5
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x18]
call fcn.30027990
mov ebp, dword [esp + 0x10]
jmp 0x30028f0c
mov dword [esp + 0x14], 6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x30028f29
jmp 0x30028f21
mov ebp, dword [esp + 0x10]
push edi
mov ecx, esi
call fcn.300265d0
push edi
call fcn.30208320
push ebp
call fcn.30208320
mov eax, dword [esp + 0x1c]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14