joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4718f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x471936
call fcn.004825cb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x471936
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47192d
xor eax, eax
jmp 0x47193e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00471944
pop edi
pop esi
pop ebx
ret 4

Function at 0x472b13
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x472b35
cmp dword [edi + 0x3c], 0
jne 0x472b35
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004825cb
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00472b62
pop edi
pop esi
pop ebx
ret 8

Function at 0x48395a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x493a0a
mov ecx, 0x4c5ab8
call fcn.00483540
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, eax
cmp word [esi + 8], 0
jne 0x4839e8
push str.COMCTL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x4839c6
mov ecx, dword [ebp + 0x10]
push 5
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
movzx ecx, cx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4839c6
push ebx
push edi
push eax
call fcn.004749e8
add esp, 0xc
mov eax, dword [edi]
mov eax, dword [eax - 8]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 4], eax
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ax, word [ebx]
mov word [esi + 8], ax
push dword [esi + 4]
mov ecx, edi
call fcn.0047386e
mov si, word [esi + 8]
xor eax, eax
mov word [ebx], si
cmp si, 0xffff
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
Function at 0x30005733
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x300283c0], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
je 0x30005756
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov dword [ebp - 4], eax
jmp 0x300057a1
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push edi
mov ebx, eax
push edi
push 0xffffffffffffffff
push ebx
push edi
push edi
call esi
cmp eax, edi
jne 0x30005779
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
inc eax
mov dword [ebp - 8], eax
add eax, eax
push eax
lea eax, [ebp - 4]
push eax
call fcn.3001e320
test eax, eax
je 0x30005841
push dword [ebp - 8]
push dword [ebp - 4]
push 0xffffffffffffffff
push ebx
push edi
push edi
call esi
mov eax, dword [ebp - 4]
mov cx, word [eax]
push 2
pop edx
cmp cx, 0x22
push 0x20
pop esi
jne 0x300057c8
add eax, edx
mov cx, word [eax]
cmp cx, 0x22
je 0x300057c4
cmp cx, di
je 0x300057d4
add eax, edx
jmp 0x300057b2
add eax, edx
jmp 0x300057d4
cmp cx, si
jbe 0x300057d4
add eax, edx
cmp word [eax], si
ja 0x300057cd
mov cx, word [eax]
cmp cx, di
je 0x300057e1
cmp cx, si
jbe 0x300057c4
push eax
mov dword [0x300285cc], edi
call fcn.30007762
cmp dword [ebp - 8], edi
mov ebx, eax
je 0x300057fc
push dword [ebp - 4]
call fcn.3001e422
mov eax, ebx
and eax, 0x60
jne 0x30005847
push 8
pop eax
test al, bl
jne 0x30005847
mov edx, 0x2ee
test edx, ebx
je 0x30005841
xor ecx, ecx
push 1
pop eax
shl eax, cl
test edx, eax
je 0x3000582a
test ebx, eax
je 0x3000582a
mov edi, ebx
sub edi, eax
test edx, edi
jne 0x30005841
inc ecx
cmp ecx, esi
jb 0x30005815
test bl, 4
je 0x30005845
mov ecx, ebx
mov eax, 0x100
and ecx, eax
cmp ecx, eax
je 0x30005845
xor eax, eax
jmp 0x30005847
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x3000584c
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x300285cc]
push esi
xor esi, esi
mov dword [0x30024c0c], eax
push esi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, esi
mov dword [0x30024c08], eax
je 0x300058bb
cmp dword [eax], 0x1c50
jne 0x300058bb
cmp dword [eax + 0x20], esi
je 0x300058bb
cmp dword [eax + 0x14], esi
je 0x300058bb
cmp dword [eax + 0x1c], esi
je 0x300058bb
cmp dword [0x300285dc], esi
jne 0x30005892
cmp dword [eax + 0x24], esi
je 0x300058bb
mov eax, dword [eax + 0x28]
push 1
test al, 0x20
pop ecx
je 0x300058a2
mov dword [0x30028380], ecx
test al, 0x10
je 0x300058ac
mov dword [0x3002837c], ecx
test ah, 0x80
je 0x300058b7
mov dword [0x300285ec], ecx
mov eax, ecx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x30007d98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov al, byte [0x30007d2c]
push ebx
push esi
push edi
push 0xe
mov byte [ebp - 1], al
pop ecx
xor esi, esi
push 0xfffffffffffffff8
xor eax, eax
push dword [ebp + 8]
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x40], esi
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.DLL_GetWindowLongA]
mov edi, dword [sym.imp.USER32.DLL_SetWindowPos]
push 3
push esi
push esi
push esi
mov ebx, eax
push esi
push 0xfffffffffffffffe
push ebx
call edi
push 3
push esi
push esi
push esi
push esi
push esi
push ebx
call edi
push 3
push esi
push esi
push esi
push esi
push ebx
push dword [ebp + 8]
call edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], esi
je 0x30007e44
push 0x30007d30
call fcn.3000d459
test eax, eax
je 0x30007e44
push dword [0x3002b96c]
lea eax, [ebp - 0x5c]
push 0x30007d40
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
lea eax, [ebp - 0x5c]
add esp, 0xc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x30], 0x30007d44
mov dword [ebp - 0x24], 0xa
call dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
jmp 0x30007e81
mov eax, dword [edi + 0x24]
cmp eax, esi
jne 0x30007e4e
lea eax, [ebp - 1]
mov edi, dword [edi + 0x64]
cmp edi, esi
jne 0x30007e58
lea edi, [ebp - 1]
push edi
push eax
push dword [0x3002b96c]
lea eax, [ebp - 0x460]
push 0x30007d54
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x460]
push eax
call fcn.3000c1c9
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x3000a05f
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
ret 8

Function at 0x3000aa85
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x84], 2
pop edi
jne 0x3000aaee
cmp dword [ebp - 0x90], 4
push 1
jae 0x3000aace
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
cmp dword [ebp - 0x90], 5
pop eax
mov dword [0x300283c0], eax
mov dword [0x3002b970], eax
jb 0x3000ab15
mov dword [0x300283b8], eax
mov dword [0x300283bc], eax
leave
ret
push 1
pop eax
cmp dword [ebp - 0x84], eax
je 0x3000ab00
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
cmp dword [ebp - 0x8c], 0
jbe 0x3000ab0e
mov dword [0x300283b8], eax
and dword [0x300283c0], 0
leave
ret
Function at 0x3000abcb
Capabilities:
Link many functions at runtime

Disassembly:
or dword [0x300283b4], 0xffffffff
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [0x3002466c], ebx
mov dword [0x300283a8], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov dword [0x300283b0], eax
mov ecx, 0x5fc
xor eax, eax
mov edi, 0x30025910
push 0x3002593c
rep stosd dword es:[edi], eax
mov dword [0x300285d4], ebx
mov dword [0x30024674], ebx
call esi
call fcn.3000aa85
mov ecx, 0x341
xor eax, eax
mov edi, 0x30024c08
rep stosd dword es:[edi], eax
mov ecx, 0x152
mov edi, 0x300246c0
rep stosd dword es:[edi], eax
mov eax, 0x30024610
push eax
mov dword [0x30024c00], eax
call esi
push 0x30024630
call esi
mov edx, 0x200
xor eax, eax
mov ecx, edx
mov edi, 0x30027b78
rep stosd dword es:[edi], eax
mov ecx, edx
mov edi, 0x30027378
rep stosd dword es:[edi], eax
push 0x300252b8
call fcn.3000c358
push 0x300252c8
call fcn.3000c358
push 0x300252d8
call fcn.3000c358
push 0x106
push 0x10
call fcn.3001e0d5
cmp eax, ebx
je 0x3000ac99
mov ecx, eax
call fcn.3000af7e
jmp 0x3000ac9b
xor eax, eax
cmp eax, ebx
mov dword [0x30024668], eax
je 0x3000acb3
push 2
push 0x100
push 0x10
push eax
call fcn.3002101d
push ebx
push 0x30028388
push ebx
push 0x30
call dword [sym.imp.USER32.DLL_SystemParametersInfoA]
mov edi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push 0x3000ab18
call edi
mov ebp, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
mov dword [0x30024664], eax
je 0x3000ad51
push 0x3000ab24
push eax
call esi
push 0x3000ab34
mov dword [0x300285f4], eax
push dword [0x30024664]
call esi
push 0x3000ab40
mov dword [0x300285f8], eax
push dword [0x30024664]
call esi
push 0x3000ab4c
mov dword [0x300285fc], eax
push dword [0x30024664]
call esi
cmp dword [0x300285f4], ebx
mov dword [0x30028600], eax
je 0x3000ad43
cmp dword [0x300285f8], ebx
je 0x3000ad43
cmp dword [0x300285fc], ebx
je 0x3000ad43
cmp eax, ebx
jne 0x3000ad51
push dword [0x30024664]
call ebp
mov dword [0x30024664], ebx
push 0x3000ab58
call edi
cmp eax, ebx
mov dword [0x3002465c], eax
je 0x3000ad80
push 0x3000ab64
push eax
call esi
cmp eax, ebx
mov dword [0x30024660], eax
jne 0x3000ad80
push dword [0x3002465c]
call ebp
mov dword [0x3002465c], ebx
push 0x3000ab74
call edi
cmp eax, ebx
mov dword [0x30024648], eax
je 0x3000adfd
push 0x3000ab80
push eax
call esi
push 0x3000ab98
mov dword [0x30024658], eax
push dword [0x30024648]
call esi
push 0x3000abac
mov dword [0x30024654], eax
push dword [0x30024648]
call esi
push 0x3000abbc
mov dword [0x30024650], eax
push dword [0x30024648]
call esi
cmp dword [0x30024658], ebx
mov dword [0x3002464c], eax
je 0x3000adef
cmp dword [0x30024654], ebx
je 0x3000adef
cmp dword [0x30024650], ebx
je 0x3000adef
cmp eax, ebx
jne 0x3000adfd
push dword [0x30024648]
call ebp
mov dword [0x30024648], ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x3000b5bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.3000b4bd
test eax, eax
je 0x3000b6b4
mov edi, dword [ebp - 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.3000e2bc
mov edi, eax
cmp byte [edi], 0x5c
jne 0x3000b6b4
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
push 0x20019
lea eax, [ebp - 0x110]
push ebx
push eax
mov byte [edi], bl
push dword [ebp - 4]
inc edi
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x3000b6b4
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
sub eax, ebx
je 0x3000b686
dec eax
je 0x3000b669
dec eax
jne 0x3000b6ab
lea eax, [esi + 8]
push 3
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp + 0xc]
call fcn.3000b3aa
test eax, eax
je 0x3000b6ab
jmp 0x3000b6a5
push 1
lea eax, [esi + 8]
pop ebx
push ebx
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp + 0xc]
call fcn.3000b3aa
test eax, eax
je 0x3000b6ab
mov dword [esi], ebx
jmp 0x3000b6ab
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x3000b6ab
mov dword [esi], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x3000b962
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x300283c0], 0
je 0x3000b9de
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.3000b4bd
test eax, eax
je 0x3000b9de
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x3000b9de
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x800
push eax
lea eax, [ebp - 0x10]
push 0x30027b78
push eax
push 0
push 0x3000b944
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x3000b9d5
cmp dword [ebp - 0x10], 1
je 0x3000b9d5
and word [0x30027b78], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
leave
ret 4

Function at 0x3000b9e2
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [0x30024c08]
add eax, 0xf3c
push eax
push 0x30024120
call fcn.3000b5bc
mov eax, dword [0x30024c08]
test byte [eax + 0x28], 1
je 0x3000ba07
jmp fcn.3000b7f9
add eax, 0x1040
push eax
push 0x30024138
call fcn.3000b5bc
ret
Function at 0x3000c06a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
mov dword [ebp - 0x68], 0x44
rep stosd dword es:[edi], eax
xor esi, esi
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], esi
cmp dword [0x300283c0], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
je 0x3000c0bd
mov edi, dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push esi
mov ebx, 0x300015e4
push esi
push ebx
call edi
mov dword [ebp - 0xc], eax
add eax, eax
push eax
lea eax, [ebp - 8]
push eax
call fcn.3001e320
test eax, eax
jne 0x3000c0c4
xor eax, eax
jmp 0x3000c1c2
push dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
call edi
push esi
push esi
push 0xffffffffffffffff
mov ebx, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push dword [ebp + 8]
push esi
push dword [0x3002839c]
call ebx
push 0x30001654
mov dword [ebp - 0x10], eax
call fcn.3001f5fb
push 0x30001644
mov edi, eax
call fcn.3001f5fb
mov ecx, dword [ebp - 0x10]
add ecx, edi
add eax, ecx
mov ecx, dword [ebp - 0xc]
lea eax, [eax + ecx + 4]
lea edi, [eax + eax]
lea eax, [ebp - 4]
push edi
push eax
call fcn.3001e320
test eax, eax
je 0x3000c1b7
mov ecx, edi
mov edi, dword [ebp - 4]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x30001644
and ecx, 3
rep stosb byte es:[edi], al
push dword [ebp - 8]
push 0x3000c05a
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0x10
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.3001f5fb
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push dword [0x3002839c]
call ebx
push dword [ebp - 4]
push 0x30001654
call fcn.3001f688
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x3000c1af
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x14], 1
call esi
push dword [ebp - 0x20]
call esi
push dword [ebp - 4]
call fcn.3001e422
push dword [ebp - 8]
call fcn.3001e422
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x3000c36a
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x3000c3e0
xor edi, edi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x3000c3d5
cmp eax, edi
je 0x3000c3d5
push edi
push eax
push edi
push 8
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x3000c3d5
push edi
push edi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x3000c3d0
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [esi + 4]
call ebx
push dword [esi]
mov dword [esi + 4], edi
call ebx
or dword [esi], 0xffffffff
xor eax, eax
pop ebx
jmp 0x3000c3e2
push 1
pop eax
jmp 0x3000c3e2
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or dword [esi], 0xffffffff
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x3000d459
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 4

Function at 0x3000e1e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x300283c0], esi
je 0x3000e1fc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
jmp 0x3000e244
push esi
push esi
push esi
mov ebx, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push esi
call ebx
mov edi, eax
lea eax, [ebp - 4]
inc edi
push edi
push eax
call fcn.3001e320
test eax, eax
je 0x3000e244
push esi
push esi
push edi
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push esi
call ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push dword [ebp - 4]
mov esi, eax
call fcn.3001e422
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x3000e909
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
cmp dword [0x300283c0], ecx
mov dword [ebp - 4], ecx
je 0x3000e931
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_LoadStringW]
jmp 0x3000e9d4
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, eax
push esi
shr eax, 4
and ebx, 0xf
inc eax
movzx eax, ax
push edi
push ecx
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceExA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
call esi
test edi, edi
je 0x3000e9c7
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
call esi
test edi, edi
je 0x3000e9c7
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
call esi
test edi, edi
je 0x3000e9c7
test ebx, ebx
jle 0x3000e98d
movzx eax, word [edi]
dec ebx
lea edi, [edi + eax*2 + 2]
jne 0x3000e983
movzx eax, word [edi]
mov edx, dword [ebp + 0x14]
lea ecx, [eax + 1]
cmp edx, ecx
jge 0x3000e99d
dec edx
jmp 0x3000e99f
mov edx, eax
lea eax, [edx + edx]
lea esi, [edi + 2]
mov edi, dword [ebp + 0x10]
mov ecx, eax
mov ebx, ecx
mov dword [ebp - 4], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x10]
and word [eax + ecx], 0
test edx, edx
jne 0x3000e9ce
mov eax, dword [ebp + 0x10]
and word [eax], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x3000eae8
Capabilities:
Get common file path
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push edi
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
test eax, eax
je 0x3000eb1d
lea eax, [ebp - 0x10c]
push eax
push 0x3000ea46
call edi
push 0x3000ea52
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xor ebx, ebx
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x3000ebd6
push esi
push 0x3000ea62
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x3000ebcc
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 0x26
push ebx
call esi
test eax, eax
jne 0x3000eb6c
lea eax, [ebp - 0x10c]
push eax
push 0x3000ea76
call edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 0x2b
push ebx
call esi
test eax, eax
jne 0x3000eb8c
lea eax, [ebp - 0x10c]
push eax
push 0x3000ea82
call edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 0x1a
push ebx
call esi
test eax, eax
jne 0x3000ebac
lea eax, [ebp - 0x10c]
push eax
push 0x3000ea8e
call edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 5
push ebx
call esi
test eax, eax
jne 0x3000ebcc
lea eax, [ebp - 0x10c]
push eax
push 0x3000ea96
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop esi
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push 0x3000eaa2
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x3000ec5a
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 0x3000ead6
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x3000ec51
lea eax, [ebp - 0x10c]
push eax
call fcn.3001f574
cmp byte [ebp + eax - 0x10d], 0x5c
jne 0x3000ec43
lea eax, [ebp - 0x10c]
push eax
call fcn.3001f574
mov byte [ebp + eax - 0x10d], bl
lea eax, [ebp - 0x10c]
push eax
push 0x3000eade
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop edi
pop ebx
leave
ret

Function at 0x3000f3c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 1
pop esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
mov dword [ebp - 4], 4
push dword [ebp + 0xc]
push SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
je 0x3000f3f4
xor eax, eax
jmp 0x3000f41c
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
je 0x3000f411
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x3000f421
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x3000f447
cmp dword [ebp + 0x10], esi
je 0x3000f467
push 0x106
push dword [ebp + 0x10]
call fcn.3001e0d5
mov ebx, eax
cmp ebx, esi
jne 0x3000f44b
xor eax, eax
jmp 0x3000f49a
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, ecx
push edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
pop edi
jmp 0x3000f46a
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x3000f488
push ebx
call dword [ebp + 8]
jmp 0x3000f497
lea eax, [ebp - 4]
push eax
push dword [0x30024668]
call fcn.30021153
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc