joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3004caf6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call fcn.30046204
test eax, eax
jne 0x3004cb13
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
push ebx
push esi
push edi
push eax
push 0x11
call fcn.30045d43
push dword [ebp - 0x1c]
push 0x12
call fcn.30045d43
push 0x3000a658
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x3004cc15
push 0x3000a638
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x3004cc15
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x3004cc15
push dword [ebp - 4]
call fcn.300430c2
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x3004cc0d
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
je 0x3004cc0d
mov eax, dword [ebp - 4]
push 0x18
xor edx, edx
pop ecx
div ecx
xor ebx, ebx
and dword [ebp - 8], ebx
xor esi, esi
test eax, eax
jbe 0x3004cc0d
mov edx, edi
mov edi, eax
mov eax, dword [edx + 4]
sub eax, 0
je 0x3004cbc5
dec eax
dec eax
jne 0x3004cbd6
push dword [edx]
call fcn.3004c403
cmp ebx, eax
pop ecx
ja 0x3004cbd6
mov ebx, eax
jmp 0x3004cbd6
push dword [edx]
inc dword [ebp - 8]
call fcn.3004c403
cmp esi, eax
pop ecx
ja 0x3004cbd6
mov esi, eax
add edx, 0x18
dec edi
jne 0x3004cba9
test esi, esi
je 0x3004cbeb
push esi
push 0x19e1
call fcn.30045d43
test ebx, ebx
je 0x3004cbfa
push ebx
push 0x19e2
call fcn.30045d43
cmp dword [ebp - 8], 0
je 0x3004cc0d
push dword [ebp - 8]
push 0x19e0
call fcn.30045d43
push dword [ebp - 0xc]
call fcn.3004311f
xor esi, esi
cmp dword [ebp - 0x1c], esi
ja 0x3004cc30
push esi
push 0x72766c74
call fcn.30043574
cmp dword [ebp - 0x1c], esi
jbe 0x3004ccc3
push 0x3000a61c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
jne 0x3004cc49
push esi
push 0x3366646b
jmp 0x3004cc61
push 0x3000a604
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x3004cc68
push eax
push 0x3366646c
call fcn.30043574
jmp 0x3004ccb8
mov eax, dword [ebp - 0x1c]
push 0x18
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call fcn.300430c2
mov esi, eax
test esi, esi
je 0x3004ccb8
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x18
push eax
push esi
push 0
push 0
push 0xb
call edi
test eax, eax
je 0x3004cca7
push 0
push 0x72766c76
call fcn.30043574
jmp 0x3004ccb1
push dword [esi + 4]
push 0x10
call fcn.30045d43
push esi
call fcn.300257dd
pop ecx
test ebx, ebx
je 0x3004ccc3
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3004cd2b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], esi
xor ebx, ebx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov word [ebp - 0x20c], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x3004cde0
push esi
push 0x33753467
call fcn.30043574
mov edi, 0x3a98
push edi
push 0xfa1
call fcn.30045d43
push edi
push 0xfa2
call fcn.30045d43
push edi
push 0xfa3
call fcn.30045d43
push edi
push 0xfa4
call fcn.30045d43
cmp ebx, esi
je 0x3004cdd1
push ebx
call fcn.300257dd
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.300696c7
leave
ret
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.30064cd0
mov edi, eax
cmp edi, esi
je 0x3004cd95
push edi
call fcn.300430c2
mov ebx, eax
cmp ebx, esi
jne 0x3004ce0d
push esi
push 0x33753468
jmp 0x3004cd90
push ebx
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.30064cd6
test eax, eax
jne 0x3004ce2b
push esi
push 0x33753469
jmp 0x3004cd90
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x30003970
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x3004ce53
push esi
push 0x3375346a
jmp 0x3004cd90
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xa]
push eax
push 0xfa1
call fcn.30045d43
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 8]
push eax
push 0xfa2
call fcn.30045d43
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xe]
push eax
push 0xfa3
call fcn.30045d43
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xc]
push eax
jmp 0x3004cdbc

Function at 0x3004d1ab
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x3004d24c
cmp dword [ebp - 0x90], 2
mov edx, dword [ebp - 0x98]
mov dword [0x300d5280], edx
jne 0x3004d240
mov eax, dword [ebp - 0x9c]
cmp eax, 5
mov cx, word [ebp - 0xc]
mov dword [0x300d527c], eax
mov word [0x300d5284], cx
jne 0x3004d22a
xor eax, eax
inc eax
cmp edx, eax
jb 0x3004d24c
test cx, cx
mov dword [0x300d5288], eax
ja 0x3004d21e
cmp edx, eax
jbe 0x3004d223
mov dword [0x300d528c], eax
cmp cx, ax
jbe 0x3004d24c
jmp 0x3004d239
jbe 0x3004d24c
xor eax, eax
inc eax
mov dword [0x300d5288], eax
mov dword [0x300d528c], eax
mov dword [0x300d5290], eax
jmp 0x3004d24c
push 0
push 0x77617376
call fcn.30043574
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
xor ecx, ebp
mov dword [section..data], eax
call fcn.300696c7
leave
ret
Function at 0x3004d41f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x300d6750], 0
je 0x3004d442
mov eax, dword [0x300d674c]
jmp 0x3004d4c1
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
je 0x3004d47e
test byte [ebp - 8], 0x10
je 0x3004d47e
xor eax, eax
inc eax
jmp 0x3004d4b1
mov ecx, dword [0x300d527c]
xor eax, eax
cmp ecx, 5
mov dword [0x300d674c], eax
jg 0x3004d49a
jne 0x3004d4b6
cmp dword [0x300d5280], eax
jbe 0x3004d4b6
lea eax, [ebp - 0xa0]
push eax
call esi
test eax, eax
je 0x3004d4af
test word [ebp - 8], 0x100
jne 0x3004d479
xor eax, eax
mov dword [0x300d674c], eax
mov dword [0x300d6750], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.300696c7
leave
ret

Function at 0x30059e02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059e8d
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059e40
cmp byte [eax], 0
je 0x30059e84
lea eax, [eax + 1]
test eax, 3
je 0x30059e40
cmp byte [eax], 0
je 0x30059e84
lea eax, [eax + 1]
test eax, 3
je 0x30059e40
cmp byte [eax], 0
je 0x30059e84
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x30059e40
test cl, cl
lea eax, [eax - 4]
je 0x30059e84
test ecx, 0xff00
lea eax, [eax + 1]
je 0x30059e84
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x30059e84
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x30059e84
lea eax, [eax + 1]
jmp 0x30059e40
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x30059e93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059f05
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059ec4
cmp word [eax], 0
je 0x30059ebd
lea eax, [eax + 2]
test eax, 3
je 0x30059ec4
jmp 0x30059eab
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30059eff
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x30059ec4
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30059eff
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30059eff
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x30059ec4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x3005eb49
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3005eb63
test al, 0x10
je 0x3005eb63
xor eax, eax
inc eax
jmp 0x3005eb65
xor eax, eax
pop ebp
ret 4

Function at 0x300603c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call dword [sym.imp.MSVCR80.dll__vsnprintf]
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.300696c7
leave
ret

Function at 0x30063b4d
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x300d7304
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x30063b9e
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x300d7308], eax
mov ax, word [ebp - 0x30]
mov word [0x300d730c], ax
mov eax, dword [ebp - 0x18]
mov dword [0x300d7310], eax
mov eax, dword [ebp - 0x40]
mov dword [0x300d7314], eax
mov eax, esi
pop esi
leave
ret

Function at 0x30066897
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x300d73d4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x300668c0
mov edi, 0x8ff000ff
jmp 0x30066905
test ebx, ebx
je 0x30066900
call fcn.300660f6
mov edi, eax
test edi, edi
jl 0x30066905
push esi
call fcn.3006506d
mov esi, eax
test esi, esi
je 0x30066900
test byte [esi + 0x1f], 4
jne 0x300668f7
push esi
call fcn.30065c93
mov edi, eax
test edi, edi
jge 0x300668f7
cmp edi, 0x8007000e
je 0x30066905
xor edi, edi
mov eax, dword [ebp + 0xc]
dec eax
je 0x30066918
dec eax
je 0x30066930
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.300696c7
leave
ret 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x30066930
cmp byte [esi + 0x1e], 0
jbe 0x30066930
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x30066905
cmp dword [esi + 8], 0x1000
jne 0x30066957
call fcn.3006924b
test al, al
je 0x30066957
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 4]
call fcn.300691ed
jmp 0x3006696b
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x30066900
lea eax, [ebp - 0xc]
push eax
call fcn.30065055
push ebx
push eax
call fcn.30066042
mov edi, eax
jmp 0x30066905
Function at 0x30066983
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x300d73bc
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [esi + 0x1f], 2
jne 0x30066b98
mov eax, dword [esi + 0x14]
cmp eax, ebx
push edi
mov edi, 0x300d73f8
je 0x300669d9
push eax
mov ecx, edi
call fcn.3006904d
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x30066ada
lea eax, [ebp - 0x23c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x3002219c
push ebx
call fcn.30067ed9
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x30066ada
mov eax, dword [ebp - 0x238]
push 4
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or eax, ecx
push eax
mov ecx, edi
call fcn.30069023
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x30066aea
cmp dword [ebp - 0x238], ebx
mov dword [ebp - 0x21c], ebx
jbe 0x30066aae
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x23c]
push dword [eax + ecx*4]
call fcn.3006637f
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x30066a93
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x224]
mov dword [ecx + eax*4], edx
inc byte [esi + 0x1d]
jmp 0x30066a9a
cmp eax, 0x8007000e
je 0x30066ac5
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x238]
jb 0x30066a59
cmp byte [esi + 0x1d], bl
jne 0x30066b84
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
jmp 0x30066b84
push dword [esi + 0x14]
mov ecx, edi
call fcn.3006904d
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
jmp 0x30066b97
push 4
mov ecx, edi
call fcn.30069023
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x30066af9
mov dword [ebp - 0x218], 0x8007000e
jmp 0x30066b97
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
call fcn.3006924b
test al, al
je 0x30066b29
cmp dword [esi + 8], 0x1000
jne 0x30066b29
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 4]
call fcn.300691ed
jmp 0x30066b40
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x30066b84
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], ebx
call fcn.300650d3
test eax, eax
je 0x30066b78
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.3006833a
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x30066b97
cmp dword [esi + 8], 0xc00
je 0x30066b91
or byte [esi + 0x1f], 2
mov dword [ebp - 0x218], ebx
pop edi
push 0x300d73bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], ebx
pop esi
pop ebx
je 0x30066bb9
lea eax, [ebp - 0x23c]
push eax
call fcn.30067f46
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.300696c7
leave
ret 4
Function at 0x3006924b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x300d7407], 0
jne 0x300692a5
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x3006929e
cmp dword [ebp - 0x110], 2
jne 0x3006929e
cmp dword [ebp - 0x11c], 6
jb 0x3006929e
call fcn.30069100
mov byte [0x300d7406], al
mov byte [0x300d7407], 1
mov ecx, dword [ebp - 4]
mov al, byte [0x300d7406]
xor ecx, ebp
call fcn.300696c7
leave
ret

Function at 0x30069613
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x30022270
push 0x3000a658
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x30069648
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x3002226c
push ebx
call edi
test esi, esi
mov dword [0x3002226c], esi
jne 0x300696ac
mov dword [0x3002226c], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x300bcb40], 0x44bf19b1
pop ebx
leave
ret
Function at 0x300696c7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3002226c]
jne 0x3006a3eb
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x300d7570], eax
mov dword [0x300d756c], ecx
mov dword [0x300d7568], edx
mov dword [0x300d7564], ebx
mov dword [0x300d7560], esi
mov dword [0x300d755c], edi
mov word [0x300d7588], ss
mov word [0x300d757c], cs
mov word [0x300d7558], ds
mov word [0x300d7554], es
mov word [0x300d7550], fs
mov word [0x300d754c], gs
pushfd
pop dword [0x300d7580]
mov eax, dword [ebp]
mov dword [0x300d7574], eax
mov eax, dword [ebp + 4]
mov dword [0x300d7578], eax
lea eax, [ebp + 8]
mov dword [0x300d7584], eax
mov eax, dword [ebp - 0x320]
mov dword [0x300d74c0], 0x10001
mov eax, dword [0x300d7578]
mov dword [0x300d7474], eax
mov dword [0x300d7468], 0xc0000409
mov dword [0x300d746c], 1
mov eax, dword [0x3002226c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x300bcb40]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x300d74b8], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x30022540
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x300d74b8], 0
jne 0x3006a4db
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x300696df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x30005b84
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30069737
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push 0x30005b7c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x30069737
mov al, 1
jmp 0x30069739
xor al, al
leave
ret 8
Function at 0x30069f71
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x30088818
call fcn.30069f87
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300d88f8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30069d10
cmp eax, esi
jne 0x30069d03
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30069d13
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30069cea
xor esi, esi
inc esi
mov eax, dword [0x300d88f4]
cmp eax, esi
jne 0x30069d26
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30069d55
mov eax, dword [0x300d88f4]
test eax, eax
jne 0x30069d4f
mov dword [0x300d88f4], esi
push 0x3000169c
push 0x30001690
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30069d55
jmp 0x30069e7d
mov dword [0x300d7460], esi
mov eax, dword [0x300d88f4]
cmp eax, esi
jne 0x30069d79
push 0x3000168c
push 0x30001674
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300d88f4], 2
test ebx, ebx
jne 0x30069d85
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300d8904], 0
je 0x30069da9
push 0x300d8904
call fcn.3006a5ae
pop ecx
test eax, eax
je 0x30069da9
push 0
push 2
push 0
call dword [0x300d8904]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30069e05
test al, al
je 0x30069dc3
cmp dword [ebp - 0x1c], 0
jne 0x30069e05
mov al, byte [esi]
test al, al
je 0x30069dd3
cmp al, 0x20
ja 0x30069dd3
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30069dc3
test byte [ebp - 0x3c], 1
je 0x30069ddf
movzx eax, word [ebp - 0x38]
jmp 0x30069de2
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x300d745c], eax
cmp dword [0x300d7450], 0
jne 0x30069e59
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30069e14
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30069e27
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30069db0
cmp dword [0x300d7460], 0
jne 0x30069e68
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x300d745c]
jmp 0x30069e89
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30069fcc
ret
call fcn.30069613
jmp 0x30069cb0
Function at 0x3006a806
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x3006a834
xor eax, eax
jmp 0x3006a85c
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x3006a851
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x3006a861
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 4

Function at 0x3006a87b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x3002226c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x3006a8e3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x3006a8da
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.300696c7
leave
ret