joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30003554
Capabilities:
Download url
Receive data

Disassembly:
push rbx
push rdi
sub rsp, 0x258
mov rax, qword [0x3000a228]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
je 0x30003624
cmp word [rcx], bx
je 0x30003624
mov rdx, rcx
lea r8d, [rbx + 7]
lea rcx, str.http:__
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
je 0x300035cf
lea r8d, [rbx + 8]
lea rcx, str.https:__
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
je 0x300035cf
lea r8d, [rbx + 6]
lea rcx, str.ftp:__
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
jne 0x30003624
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [rax], bx
je 0x300035e1
add rax, 2
lea r9, [rsp + 0x30]
mov r8, rax
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WININET.dll_CreateUrlCacheEntryW]
cmp eax, ebx
je 0x30003624
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call sub.urlmon.dll_URLDownloadToFileW
cmp eax, ebx
jl 0x30003624
lea rcx, [rsp + 0x30]
call fcn.30007b64
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.30007ea0
add rsp, 0x258
pop rdi
pop rbx
ret

Function at 0x30003bd4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov rax, rsp
sub rsp, 0x40
mov rsi, qword [rsp + 0x80]
mov rbx, r9
mov rdi, r8
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], r9
lea r9, [rax - 0x10]
xor r8d, r8d
mov dword [rax - 0x10], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x30003c55
test rsi, rsi
mov edx, dword [rsp + 0x30]
jne 0x30003c29
test rbx, rbx
jmp 0x30003c45
test rbx, rbx
je 0x30003c4e
cmp edx, 1
je 0x30003c38
cmp edx, 2
jne 0x30003c4e
cmp dword [rsi], 2
jb 0x30003c47
mov eax, dword [rsi]
cmp word [rax + rbx - 2], 0
je 0x30003c4e
mov ecx, 0x8000ffff
jmp 0x30003c55
test rdi, rdi
je 0x30003c55
mov dword [rdi], edx
mov eax, ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x30003e54
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
xor edi, edi
test rcx, rcx
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x60], 0
je 0x30003fc3
cmp word [rcx], di
je 0x30003fc3
test rdx, rdx
je 0x30003fc3
cmp qword [rdx], rdi
jne 0x30003fc3
mov rdx, qword [str.SOFTWAREMicrosoftSharedXMLAlternateProgIDs]
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070002
je 0x30003fb4
test ebx, ebx
js 0x30003fc8
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x70], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
xor eax, eax
test ebx, ebx
cmovns eax, dword [rsp + 0x70]
cmp ebx, 0x80070002
mov dword [rsp + 0x70], eax
je 0x30003fb4
cmp eax, 1
je 0x30003f3d
cmp eax, 2
jne 0x30003fb4
mov eax, dword [rsp + 0x60]
cmp eax, 2
jbe 0x30003fb4
test ebx, ebx
js 0x30003fc8
add eax, 2
xor ecx, ecx
mov edx, eax
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
jne 0x30003f6a
mov ebx, 0x8007000e
jmp 0x30003fc8
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call sub.MSVCR80.dll_memset
mov rcx, qword [rsp + 0x78]
add dword [rsp + 0x60], 0xfffffffe
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x70]
mov r9, rdi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.30003bd4
cmp eax, 0x80070002
mov ebx, eax
je 0x30003fb4
cmp dword [rsp + 0x70], 1
je 0x30003fb8
cmp dword [rsp + 0x70], 2
je 0x30003fb8
xor ebx, ebx
jmp 0x30003fc8
test eax, eax
js 0x30003fc8
mov qword [rsi], rdi
xor edi, edi
jmp 0x30003fc8
mov ebx, 0x80070057
mov rcx, rdi
call fcn.300034e4
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x30003fe0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x30004b28
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
test rcx, rcx
mov rdi, rdx
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x50], 0
je 0x30004c45
cmp word [rcx], 0x2e
jne 0x30004c45
test rdx, rdx
jne 0x30004b65
mov ebx, 0x80070057
jmp 0x30004c5a
lea rax, [rsp + 0x68]
mov qword [rdx], 0
mov rdx, rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x30004c4a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x60], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, dword [rsp + 0x60]
test ebx, ebx
cmovns eax, dword [rsp + 0x60]
test ebx, ebx
js 0x30004c4a
cmp eax, 1
je 0x30004c03
cmp eax, 2
je 0x30004c03
mov ebx, 0x8000ffff
jmp 0x30004c4a
mov edx, dword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov qword [rdi], rax
jne 0x30004c1e
mov ebx, 0x8007000e
jmp 0x30004c4a
mov word [rax], 0
mov r9, qword [rdi]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.30003bd4
mov ebx, eax
jmp 0x30004c4a
mov ebx, 0x80070057
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x30004c5a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x3000525c
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x3000a228]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x30], 0x201
lea edx, [rsi + 3]
mov edi, esi
call qword [sym.imp.SHLWAPI.dll_UrlIsW]
cmp eax, esi
je 0x300052cd
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x402
call sub.MSVCR80.dll_memset
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
lea r9, [rsp + 0x40]
cmp eax, esi
cmovl r9, rsi
cmp r9, rsi
jne 0x300052d0
mov r9, rbx
lea r8, str._SystemRoot__system32NOTEPAD.EXE
lea rdx, str.open
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
mov ecx, 0x80004005
cmovle edi, ecx
mov eax, edi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.30007ea0
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret

Function at 0x300055e8
Capabilities:
Print debug messages

Disassembly:
push rbx
push rdi
sub rsp, 0x28
xor ebx, ebx
mov rdi, rcx
cmp dword [0x3000c214], ebx
je 0x30005611
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x3000c214], ebx
jne 0x3000561a
call fcn.300053cc
cmp eax, ebx
je 0x30005634
mov rcx, qword [section..data]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
cmp eax, ebx
cmovne ebx, ecx
mov eax, ebx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x30005830
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov rax, rsp
sub rsp, 0x40
xor ebp, ebp
mov rsi, rdx
mov r12d, 0x80070000
cmp rdx, rbp
mov qword [rax + 0x48], rbp
mov qword [rax - 0x10], rbp
mov dword [rax + 0x38], ebp
mov rdi, rbp
jne 0x30005866
lea ebx, [r12 + 0x57]
jmp 0x300059cd
lea rax, [rsp + 0x88]
mov qword [rdx], rbp
mov rdx, rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r12d
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jl 0x300059cd
mov rdx, qword [str.shell]
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r12d
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jl 0x300059cd
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x80], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r12d
cmp eax, ebp
cmovle ebx, eax
mov eax, ebp
cmp ebx, ebp
cmovge eax, dword [rsp + 0x80]
cmp ebx, ebp
mov dword [rsp + 0x80], eax
jl 0x300059c0
cmp eax, 1
je 0x3000593f
cmp eax, 2
jne 0x300059c0
mov edx, dword [rsp + 0x78]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, rbp
mov rdi, rax
jne 0x3000595e
mov ebx, 0x8007000e
jmp 0x300059cd
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov rcx, rax
add r8, 2
call sub.MSVCR80.dll_memset
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x78]
lea r8, [rsp + 0x80]
mov r9, rdi
xor edx, edx
mov qword [rsp + 0x20], r11
call fcn.30003bd4
cmp eax, ebp
mov ebx, eax
jl 0x300059cd
cmp dword [rsp + 0x80], 1
je 0x300059b3
cmp dword [rsp + 0x80], 2
je 0x300059b3
mov ebx, 0x8000ffff
jmp 0x300059cd
cmp word [rdi], bp
je 0x300059ca
mov qword [rsi], rdi
mov rdi, rbp
jmp 0x300059cd
cmp ebx, 0x80070002
jne 0x300059cd
mov ebx, ebp
mov qword [rsi], rbp
mov rcx, rdi
call fcn.300034e4
mov rcx, qword [rsp + 0x88]
cmp rcx, rbp
je 0x30005a09
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r12d
cmp eax, ebp
cmovle ecx, eax
mov rax, qword [rsp + 0x88]
cmp ecx, ebp
cmovge rax, rbp
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x30005a19
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x30005a28
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x478
mov rax, qword [0x3000a228]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor esi, esi
mov rdi, r8
mov dword [rsp + 0x38], 0x201
cmp rcx, rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
je 0x30005b9b
cmp word [rcx], si
je 0x30005b9b
cmp r8, rsi
je 0x30005b9b
lea rax, [rsp + 0x38]
mov dword [r8], esi
mov r9, rdx
mov qword [rsp + 0x28], rax
mov r8, rcx
lea rax, [rsp + 0x50]
lea edx, [rsi + 2]
lea ecx, [rsi + 0x20]
mov word [rsp + 0x50], si
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
mov ebp, 0x80070000
cmp eax, esi
mov ebx, eax
jl 0x30005b5f
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, ebp
cmp eax, esi
cmovle ebx, eax
cmp ebx, esi
jl 0x30005b5f
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rcx, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ecx, ax
or ecx, ebp
cmp eax, esi
cmovle ecx, eax
cmp ecx, esi
jl 0x30005b5f
mov rdx, qword [str.UseURL]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, ebp
cmp eax, esi
cmovle ecx, eax
mov eax, esi
cmp ecx, esi
setge al
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x30005b89
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, ebp
cmp eax, esi
cmovle ecx, eax
mov rax, qword [rsp + 0x30]
cmp ecx, esi
cmovge rax, rsi
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, rsi
je 0x30005ba0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30005ba0
mov ebx, 0x80070057
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.30007ea0
add rsp, 0x478
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x30006324
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, rsp
sub rsp, 0x58
xor r13d, r13d
mov rsi, r8
mov rbp, rcx
cmp rcx, r13
mov dword [rax - 0x28], r13d
mov qword [rax - 0x20], r13
mov qword [rax - 0x18], r13
mov dword [rax + 0x60], r13d
mov rdi, r13
mov r14d, 0x80070000
je 0x30006369
cmp edx, r13d
je 0x30006369
cmp r8, r13
jne 0x30006373
mov ebx, 0x80070057
jmp 0x300064f8
movsxd rax, edx
mov dword [r8], r13d
lea r15, [0x3000c010]
lea r12, [rax + rax*4]
lea r8, [rsp + 0x30]
mov rdx, qword [r15 + r12*8]
call fcn.30004ce8
cmp eax, r13d
mov ebx, eax
jl 0x300064f8
cmp dword [rsp + 0x30], r13d
jne 0x300063ae
mov ebx, 1
jmp 0x300064f8
mov rdx, qword [r15 + r12*8]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r13d
cmovle ebx, eax
cmp ebx, r13d
jl 0x300064f8
mov rdx, qword [0x3000c140]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r13d
cmovle ebx, eax
cmp ebx, r13d
jl 0x300064f8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0xb8]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov dword [rsp + 0xa0], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r13d
cmovle ebx, eax
mov eax, dword [rsp + 0xa0]
cmp ebx, r13d
cmovge eax, dword [rsp + 0xa0]
cmp ebx, r13d
mov dword [rsp + 0xa0], eax
jl 0x300064f8
mov edx, dword [rsp + 0xb8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r13
mov rdi, rax
jne 0x30006497
mov ebx, 0x8007000e
jmp 0x300064f8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0xa0]
mov r9, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.30003bd4
cmp eax, r13d
mov ebx, eax
jl 0x300064f8
cmp dword [rsp + 0xa0], 1
je 0x300064dd
cmp dword [rsp + 0xa0], 2
je 0x300064dd
mov ebx, 0x80004005
jmp 0x300064f8
mov rdx, qword [0x3000c1c8]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ecx, r13d
cmp rax, r13
setne cl
mov dword [rsi], ecx
mov rcx, rdi
call fcn.300034e4
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x3000652d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r14d
cmp eax, r13d
cmovle ecx, eax
mov rax, qword [rsp + 0x38]
cmp ecx, r13d
cmovge rax, r13
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x3000653d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x30006550
Capabilities:
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov edi, r8d
mov r12d, edx
mov r13, rcx
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rsi
xor ebx, ebx
mov eax, dword [0x3000c214]
test eax, eax
je 0x30006590
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x3000c214]
test eax, eax
jne 0x3000659d
call fcn.300053cc
test eax, eax
je 0x300065b9
lea rdx, [rsp + 0x78]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x300065c1
xor eax, eax
jmp 0x3000662c
mov rax, qword [0x3000c230]
test rax, rax
jne 0x300065e5
lea rcx, str.ImageList_GetIcon
call fcn.30005640
mov qword [0x3000c230], rax
test rax, rax
je 0x300065f8
mov r8d, edi
mov edx, r12d
mov rcx, r13
call rax
mov rsi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x3000660e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x30006610
xor edi, edi
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x30006629
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x30006e94
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov rax, rsp
sub rsp, 0x50
xor ebp, ebp
mov rdi, rdx
mov dword [rax + 0x38], 6
cmp rdx, rbp
mov qword [rax - 0x20], rbp
mov rsi, rbp
mov qword [rax + 0x48], rbp
mov qword [rax + 0x40], rbp
jne 0x30006ecc
mov ebx, 0x80070057
jmp 0x30007093
mov dword [rdx], ebp
mov rcx, qword [str..xml]
lea rdx, [rsp + 0x30]
call fcn.30004b28
cmp eax, ebp
mov ebx, eax
jl 0x30007093
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x98]
call fcn.30005830
mov rsi, qword [rsp + 0x98]
cmp eax, ebp
mov ebx, eax
jl 0x30007093
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.30005bc0
mov r8d, 1
cmp eax, ebp
jl 0x30006f9c
mov edx, dword [rsp + 0x88]
cmp edx, ebp
je 0x30006f99
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x3c], ebp
mov dword [rsp + 0x40], r8d
call fcn.30006c70
cmp eax, ebp
mov ebx, eax
jl 0x30007093
cmp dword [rsp + 0x38], ebp
mov eax, r8d
mov ecx, ebp
je 0x30006f9c
bt dword [rsp + 0x3c], eax
jb 0x30006f89
add eax, r8d
cmp eax, 5
jl 0x30006f5e
jmp 0x30006f89
cmp edx, ecx
je 0x30006f99
cmp eax, 5
mov ecx, ebp
jge 0x30006f93
bt dword [rsp + 0x3c], eax
jb 0x30006f89
add eax, r8d
cmp eax, 5
jl 0x30006f7a
cmp eax, 5
jge 0x30006f93
mov ecx, eax
add eax, r8d
cmp ecx, ebp
jne 0x30006f6f
jmp 0x30006f9c
mov dword [rdi], r8d
cmp dword [rdi], r8d
mov ebx, ebp
jne 0x30007093
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.xml]
lea rax, [rsp + 0x90]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 0x80070002
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
cmp ebx, r12d
je 0x30007091
cmp ebx, ebp
jl 0x30007093
mov rdx, qword [str.Application]
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x88], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jge 0x3000703e
cmp ebx, r12d
jne 0x30007093
cmp ebx, r12d
jne 0x3000708b
mov rdx, qword [str.ProgID]
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x88], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jge 0x3000708f
cmp ebx, r12d
jne 0x30007093
cmp ebx, ebp
jl 0x30007091
mov dword [rdi], ebp
mov ebx, ebp
mov rcx, qword [rsp + 0x30]
call fcn.300034e4
mov rcx, rsi
call fcn.300034e4
mov rcx, qword [rsp + 0x90]
cmp rcx, rbp
je 0x300070b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x30007514
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x310
mov rax, qword [0x3000a228]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov r13, qword [rsp + 0x370]
xor esi, esi
test rcx, rcx
mov rdi, r9
mov r12, r8
mov rbp, rdx
mov qword [rsp + 0x30], rsi
mov r9, rcx
je 0x30007592
cmp word [rcx], si
je 0x30007592
xor ecx, ecx
test r8, r8
setne cl
xor eax, eax
test rdx, rdx
setne al
cmp eax, ecx
jne 0x30007592
xor ecx, ecx
test r13, r13
setne cl
xor eax, eax
test rdi, rdi
setne al
cmp eax, ecx
jne 0x30007592
test rdx, rdx
lea eax, [rsi - 1]
jne 0x300075c3
test rdi, rdi
jne 0x300075ce
mov ebx, 0x80070057
mov rcx, rsi
call fcn.300034e4
mov eax, ebx
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.30007ea0
add rsp, 0x310
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rdi, rdi
mov qword [rdx], rsi
mov dword [r8], eax
je 0x300075d5
mov qword [rdi], rsi
mov dword [r13], eax
lea rdx, [rsp + 0x30]
mov rcx, r9
call fcn.30006970
mov rsi, qword [rsp + 0x30]
test eax, eax
mov ebx, eax
js 0x30007597
test rbp, rbp
mov r15d, 0x2b8
je 0x30007631
lea rcx, [rsp + 0x40]
mov r8, r15
xor edx, edx
call sub.MSVCR80.dll_memset
lea r8, [rsp + 0x40]
mov r9d, r15d
mov edx, 0x80
mov rcx, rsi
mov dword [rsp + 0x20], 0x4011
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov qword [rbp], rax
mov eax, dword [rsp + 0x48]
mov dword [r12], eax
test rdi, rdi
je 0x30007597
lea rcx, [rsp + 0x40]
mov r8, r15
xor edx, edx
call sub.MSVCR80.dll_memset
lea r8, [rsp + 0x40]
mov r9d, r15d
mov edx, 0x80
mov rcx, rsi
mov dword [rsp + 0x20], 0x4010
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov qword [rdi], rax
mov eax, dword [rsp + 0x48]
mov dword [r13], eax
jmp 0x30007597

Function at 0x30007d9c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x3000a230]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbx, rax
je 0x30007ddc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rax
call rbx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rbx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r11d, eax
xor rbx, r11
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r11d, eax
xor rbx, r11
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x40]
mov r11d, eax
xor rbx, r11
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor rbx, qword [rsp + 0x40]
mov edx, 8
lea r9, [rsp + 0x30]
lea rcx, [0x3000a228]
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x30]
test rbx, rbx
movabs r11, 0x2b992ddfa23249d6
lea r9, [rsp + 0x30]
lea rcx, [0x3000a228]
cmovne r11, rbx
mov edx, 8
mov qword [0x3000a228], r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movabs r11, 0xd466d2205dcdb629
mov qword [0x3000c1f8], r11
add rsp, 0x20
pop rbx
ret
Function at 0x30007ea0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x3000a228]
jne 0x30007eab
repz ret
jmp 0x30008480
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x3000c300]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x3000c3f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x30008505
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x3000c300]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x30008527
mov rax, qword [rsp + 0x88]
mov qword [0x3000c3f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x3000c398], rax
mov rax, qword [0x3000c3f8]
mov qword [0x3000c270], rax
mov rax, qword [rsp + 0x90]
mov qword [0x3000c380], rax
mov dword [0x3000c260], 0xc0000409
mov dword [0x3000c264], 1
mov rax, qword [0x3000a228]
mov qword [rsp + 0x68], rax
mov rax, qword [0x3000c1f8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x3000c2f8], eax
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x3000a268]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x3000c2f8], 0
jne 0x300085ae
mov ecx, 1
call sub.MSVCR80.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret