joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f035
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0046efb1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x46f1ad
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x46f1ad
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x46f15c
jg 0x46f08e
test eax, eax
je 0x46f152
push 1
push 0x1000
call fcn.0045de84
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x46f0b4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x46f149
push 0x8000
push ebx
call fcn.0045b245
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x46f0e0
jg 0x46f0db
cmp ecx, 0x1000
jb 0x46f0e0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00462883
add esp, 0x10
cmp eax, 0xffffffff
je 0x46f125
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x46f0db
jl 0x46f10c
test ecx, ecx
jne 0x46f0cd
push dword [ebp - 0xc]
push ebx
call fcn.0045b245
push esi
call fcn.0045ddcb
add esp, 0xc
xor edi, edi
jmp 0x46f1be
cmp byte [edi + 0x24], 0
je 0x46f13c
cmp dword [edi + 0x20], 5
jne 0x46f13c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x46f147
mov edi, dword [edi + 0x18]
jmp 0x46f149
xor edi, edi
push esi
call fcn.0045ddcb
pop ecx
jmp 0x46f1be
test ecx, ecx
jg 0x46f11e
jl 0x46f15c
test eax, eax
jae 0x46f11e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004641fa
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x46f17f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x46f11e
jmp 0x46f1b6
push ebx
call fcn.004682c9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x46f11e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x46f1be
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x46f1bb
mov edi, dword [edi + 0x18]
jmp 0x46f1be
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004641fa
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46fb20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46fb4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46fb4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41ec8b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041ffc0
cmp byte [0x453898], 0
je 0x41ed1a
cmp word [0x45389a], 0
je 0x41ed1a
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x45389a
call fcn.0041d824
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ed19
push dword [ebp + 8]
call fcn.00424f93
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x41ed1e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041ffc0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.00411697
mov esi, eax
test esi, esi
je 0x41ed76
movzx ecx, word [esi]
push ecx
jmp 0x41ed61
add esi, 2
movzx eax, word [esi]
push eax
call fcn.004117b3
test al, al
jne 0x41ed5a
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
leave
ret 4
Function at 0x402480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x407928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
xor ebx, ebx
lea edi, [esi + 0xe0]
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x28], ebx
call sub.MFC42.DLL_CStringArray::SetSize
push 0x40b54c
lea ecx, [esi + 0xf4]
mov dword [esi + 0x120], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x108], ebx
call fcn.004071dc
lea eax, [esp + 0xc]
push str.http:__hu.buxihuan.com:88_api_text.php
push eax
call fcn.00401d70
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
mov ebx, 1
push 0x40b54c
push ecx
mov byte [esp + 0x30], bl
call esi
add esp, 0x10
test eax, eax
je 0x40251d
push 0x40b170
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
lea edx, [esp + 0x14]
push str.http:__nsg.greenhome001.com.cn:88_api_text.php
push edx
call fcn.00401d70
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.004071b2
mov eax, dword [esp + 0xc]
push 0x40b54c
push eax
call esi
add esp, 8
test eax, eax
je 0x4025b9
push ebx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
mov esi, eax
cmp byte [esi], 0
je 0x4025a9
mov cl, byte [esi + 1]
inc esi
cmp cl, 0x3b
jne 0x4025a4
inc esi
push eax
lea ecx, [esp + 0x14]
mov byte [esi], 0
call fcn.004071dc
mov eax, dword [edi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call sub.MFC42.DLL_CStringArray::SetAtGrow_1
mov al, byte [esi + 1]
inc esi
cmp al, 0xd
je 0x402596
cmp al, 0xa
je 0x402596
mov eax, esi
cmp byte [esi], 0
jne 0x40256f
mov eax, dword [edi + 8]
push str.Client__.Sleep_20__
push eax
mov ecx, edi
call sub.MFC42.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.004071b2
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004071b2
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x3000e2c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3000e2dc
test al, 0x10
jne 0x3000e2dc
xor eax, eax
inc eax
jmp 0x3000e2de
xor eax, eax
ret 4

Function at 0x3000e36a
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
push 0x10
pop ecx
push 7
mov esi, 0x300015e8
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x300015c4
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, 0x104
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 8]
push eax
mov ecx, esi
mov dword [ebp - 0x6c], eax
call fcn.3000d531
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x3000e3c2
push 0x300015a4
call fcn.30010597
pop ecx
jmp 0x3000e46f
lea eax, [ebp - 0x68]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x3000e3f4
lea eax, [ebp - 0x6c]
push eax
push dword [esi]
lea eax, [ebp - 0x24]
push ebx
push ebx
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x68], ebx
je 0x3000e402
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x3000e446
push 0x30001550
call fcn.300106d0
pop ecx
push dword [ebp - 0x6c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [esi]
push 0x30001440
mov ecx, esi
mov word [eax + 4], bx
call fcn.3000d701
mov edi, eax
cmp edi, ebx
je 0x3000e446
push 0x3000151c
jmp 0x3000e3b7
mov ecx, esi
call fcn.3000d772
mov edi, eax
cmp edi, ebx
je 0x3000e45d
push 0x300014f8
jmp 0x3000e3b7
push dword [esi + 4]
push dword [esi]
push 0x300014b0
call fcn.300106d0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.3001fd67
leave
ret 4
Function at 0x3000e757
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x30034b3c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], edi
xor esi, esi
call ebx
test eax, eax
je 0x3000e80b
cmp word [edi], 0x22
jne 0x3000e7a4
push edi
call ebx
mov esi, eax
dec esi
cmp word [edi + esi*2], 0x22
jne 0x3000e79f
and word [edi + esi*2], 0
lea eax, [edi + 2]
jmp 0x3000e7aa
mov eax, dword [ebp - 0x214]
mov ebx, 0x105
push ebx
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
mov dword [ebp + 8], eax
jbe 0x3000e7f0
cmp eax, ebx
ja 0x3000e7f0
cmp dword [ebp + 0xc], 0x7fffffff
jbe 0x3000e7d9
mov eax, 0x80070057
jmp 0x3000e7e9
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0xc]
push edi
call fcn.3000d4b9
mov dword [0x30076d5c], eax
jmp 0x3000e7fa
test esi, esi
je 0x3000e7fa
mov word [edi + esi*2], 0x22
xor eax, eax
cmp dword [ebp + 8], eax
jbe 0x3000e80b
cmp dword [ebp + 8], 0x104
ja 0x3000e80b
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001fd67
leave
ret 8

Function at 0x3000ebd3
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, edi
call ebx
cmp eax, 0xffffffff
je 0x3000ebf4
test al, 0x10
jne 0x3000ec85
push edi
push 0x30001948
call fcn.300106d0
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [edi + eax*2 + 2], 0x5c
je 0x3000ec33
cmp dword [ebp + 0xc], 0x7fffffff
jbe 0x3000ec20
mov eax, 0x80070057
jmp 0x3000ec2e
push 0x30001940
push dword [ebp + 0xc]
push edi
call fcn.3000d5f0
mov dword [0x30076d5c], eax
and dword [ebp + 0xc], 0
push 0x5c
push esi
call fcn.3001621d
mov esi, eax
test esi, esi
je 0x3000ec4b
and word [esi], 0
jmp 0x3000ec52
mov dword [ebp + 0xc], 1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test esi, esi
je 0x3000ec66
mov word [esi], 0x5c
inc esi
inc esi
cmp dword [ebp + 0xc], 0
je 0x3000ec37
push edi
call ebx
cmp eax, 0xffffffff
je 0x3000ec89
test al, 0x10
je 0x3000ec89
push edi
push 0x30001900
call fcn.300106d0
pop ecx
pop ecx
xor eax, eax
jmp 0x3000ec99
push edi
push 0x300018b8
call fcn.300106d0
pop ecx
pop ecx
push 3
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x3000ed46
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x30034b3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp eax, edx
mov dword [ebp - 0x464], edx
je 0x3000eec9
cmp word [eax], dx
je 0x3000eec9
mov ecx, dword [ebp + 8]
cmp ecx, edx
je 0x3000eec9
cmp word [ecx], dx
je 0x3000eec9
push ebx
push esi
push edi
push eax
mov edi, 0x105
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.3000d4b9
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x30076d5c], eax
lea eax, [ebp - 0x210]
push eax
call ebx
mov esi, eax
test esi, esi
jbe 0x3000edde
cmp esi, 0x104
jae 0x3000edde
cmp word [ebp + esi*2 - 0x212], 0x5c
je 0x3000edde
mov word [ebp + esi*2 - 0x210], 0x5c
inc esi
and word [ebp + esi*2 - 0x210], 0
cmp dword [ebp + 0x14], 0x7fffffff
jbe 0x3000edee
mov eax, 0x80070057
jmp 0x3000ee00
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.3000d4b9
push dword [ebp + 8]
mov dword [0x30076d5c], eax
call ebx
add eax, esi
cmp eax, edi
jae 0x3000ee25
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.3000d5f0
mov dword [0x30076d5c], eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x3000eeae
test byte [ebp - 0x460], 0x10
jne 0x3000ee95
cmp word [ebp - 0x22c], 0
je 0x3000ee6b
cmp dword [ebp + 0x14], 0x7fffffff
jbe 0x3000ee63
mov eax, 0x80070057
jmp 0x3000ee86
lea eax, [ebp - 0x22c]
jmp 0x3000ee7a
cmp dword [ebp + 0x14], 0x7fffffff
ja 0x3000ee5c
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.3000d5f0
mov dword [0x30076d5c], eax
mov dword [ebp - 0x464], 1
lea eax, [ebp - 0x460]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x3000eeae
and dword [ebp - 0x464], 0
test esi, esi
je 0x3000eebe
cmp esi, 0xffffffff
je 0x3000eebe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x464]
pop edi
pop esi
pop ebx
jmp 0x3000eecb
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.3001fd67
leave
ret 0x10
Function at 0x3000ff7d
Capabilities:
Check if file exists
Create directory
Get file attributes
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x598]
sub esp, 0x618
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
push dword [ebp + 0x5a0]
mov dword [ebp + 0x594], eax
xor eax, eax
xor esi, esi
mov word [ebp + 0x388], si
mov ecx, 0x82
lea edi, [ebp + 0x38a]
rep stosd dword es:[edi], eax
push 0x105
lea eax, [ebp + 0x388]
push eax
call fcn.3000d4b9
mov dword [0x30076d5c], eax
push 0x5c
lea eax, [ebp + 0x388]
push eax
call fcn.3001624c
cmp eax, esi
je 0x300100c9
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [eax], si
lea eax, [ebp + 0x388]
push eax
call edi
cmp eax, 0xffffffff
jne 0x3001001a
push esi
lea eax, [ebp + 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0x388]
push eax
call edi
cmp eax, 0xffffffff
je 0x300100c9
cmp dword [0x3007727c], esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, 0x40000000
je 0x30010048
push esi
push 0x80
push 4
push esi
push esi
push ebx
push dword [ebp + 0x5a0]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
jne 0x30010063
push esi
push 0x80
push 2
push esi
push esi
push ebx
push dword [ebp + 0x5a0]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
je 0x300100c9
push 2
push esi
push esi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push esi
push 0x400
lea eax, [ebp - 0x78]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x5a0]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call edi
push esi
lea eax, [ebp - 0x80]
push eax
push 2
push 0x30002114
push dword [ebp - 0x7c]
call edi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x300100cb
xor eax, eax
mov ecx, dword [ebp + 0x594]
pop edi
pop esi
pop ebx
call fcn.3001fd67
add ebp, 0x598
leave
ret 4
Function at 0x30010155
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x30034b3c]
and word [ebp - 0x210], 0
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
mov edi, 0x30002130
push edi
mov esi, 0x105
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.3000def7
mov dword [0x30076d5c], eax
add esp, 0x14
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x30010200
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push esi
push eax
call fcn.3000def7
mov dword [0x30076d5c], eax
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x460]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x300101c1
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001fd67
leave
ret 8

Function at 0x30010474
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x30010592
cmp byte [eax], 0
je 0x30010592
cmp word [0x300360a8], si
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push edi
mov ebp, 0x300362b8
je 0x30010550
push esi
push 0x80
push 4
push esi
push esi
push 0x40000000
push 0x300360a8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x300104d2
mov word [0x300360a8], si
jmp 0x30010550
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [0x300362b8], 0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x30010513
push 0
lea eax, [esp + 0x14]
push eax
push ebp
call ebx
push eax
push ebp
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x30002114
push edi
call esi
mov byte [0x300362b8], 0
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x3001053f
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
call ebx
push eax
push dword [esp + 0x24]
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x30002114
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [0x300360a8], 0
jne 0x3001058f
push ebp
call ebx
push dword [esp + 0x18]
mov esi, eax
call ebx
lea eax, [esi + eax + 3]
cmp eax, 0x800
jge 0x30010588
push dword [esp + 0x18]
mov esi, 0x8000
push esi
push ebp
call fcn.3000ff47
test eax, eax
jl 0x3001058f
push 0x30002114
push esi
push ebp
call fcn.3000ff47
jmp 0x3001058f
mov byte [0x300362b8], 0
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4
Function at 0x30010b2b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
cmp word [esi], 0
push edi
mov edi, 0x300566d8
je 0x30010b53
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x30003068
call fcn.300106d0
add esp, 0x14
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esi], 0
mov edi, eax
je 0x30010b7e
push dword [ebp + 0x14]
push 0x30003054
call fcn.300106d0
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x30010edd
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov eax, 0x801c
lea ebp, [esp - 0x7f9c]
call fcn.3001fd80
mov eax, dword [0x30034b3c]
push ebx
xor ebx, ebx
cmp dword [0x30076d68], ebx
mov dword [ebp + 0x7f98], eax
jne 0x30010f0d
xor eax, eax
inc eax
jmp 0x30011031
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp + 0x7f90]
push eax
mov byte [ebp + 0x7f90], bl
mov byte [ebp + 0x7f91], bl
mov byte [ebp + 0x7f92], bl
mov byte [ebp + 0x7f93], bl
mov byte [ebp + 0x7f94], bl
mov byte [ebp + 0x7f95], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x30011031
cmp dword [0x30076d68], 0x1f4
push esi
mov dword [ebp - 0x74], ebx
jb 0x30010fad
push 0x30003274
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x30011024
push 0x3000325c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x30011024
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp - 0x78]
push ebx
call eax
test eax, eax
jne 0x30010fa4
mov dword [ebp - 0x74], ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x30011024
lea eax, [ebp - 0x7c]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x30010fcb
xor eax, eax
jmp 0x30011030
lea eax, [ebp - 0x80]
push eax
push 0x8000
lea eax, [ebp - 0x70]
push eax
push 2
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x7c]
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x74], ebx
je 0x30010fc7
push edi
xor edi, edi
cmp dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
jbe 0x30011023
lea esi, [ebp - 0x6c]
push dword [esi]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x3001101c
inc edi
add esi, 8
cmp edi, dword [ebp - 0x70]
jb 0x30011002
jmp 0x30011023
mov dword [ebp - 0x74], 1
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x74]
pop esi
mov ecx, dword [ebp + 0x7f98]
pop ebx
call fcn.3001fd67
add ebp, 0x7f9c
leave
ret
Function at 0x300110b5
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
push edi
mov edi, reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
cmp ebx, 1
jne 0x300110c9
mov edi, SysReAllocString
push 0x30002a88
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
je 0x300110e3
inc ebx
cmp ebx, 2
jl 0x300110bf
jmp 0x300110ed
push 0x30003308
call fcn.300105be
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x300114ad
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x3000362c
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
push 8
pop ecx
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
mov esi, 0x3000360c
lea edi, [ebp - 0x24]
push 0x20019
rep movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
lea eax, [ebp - 0x4c]
push eax
push SysReAllocString
mov dword [ebp - 0x50], 0x105
mov dword [ebp - 0x58], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [ebp + 8]
mov ebx, 0x30002860
jne 0x300115b3
lea eax, [ebp - 0x50]
push eax
push edi
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x54]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x300115a7
cmp dword [ebp + 8], 1
jne 0x300115a7
cmp dword [ebp - 0x50], edi
je 0x300115a7
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + eax + 1]
push eax
mov ecx, esi
mov dword [ebp - 0x50], eax
call fcn.3000d531
mov edi, eax
test edi, edi
je 0x30011565
push 0x300035e0
jmp 0x30011600
mov eax, dword [esi]
lea ecx, [ebp - 0x50]
push ecx
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x300115a5
mov eax, dword [esi]
mov ecx, dword [ebp - 0x50]
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x30011597
push 0x5c
mov ecx, esi
call fcn.3000d448
push ebx
mov ecx, esi
call fcn.3000d701
mov edi, eax
test edi, edi
je 0x30011606
xor edi, edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x54], edi
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x50]
push eax
mov ecx, esi
call fcn.3000d531
inc dword [ebp - 0x58]
mov edi, eax
test edi, edi
jne 0x30011626
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
mov dword [ebp - 0x50], eax
je 0x3001162d
cmp dword [esi + 4], eax
je 0x300115b3
push 0x5c
mov ecx, esi
call fcn.3000d448
push ebx
mov ecx, esi
call fcn.3000d701
mov edi, eax
test edi, edi
je 0x30011606
push 0x300035b0
call fcn.30010597
pop ecx
cmp dword [ebp - 0x54], 0
je 0x30011615
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001fd67
leave
ret 4
push 0x300015a4
jmp 0x30011600
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x30011617