joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30015e24
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x30015e48
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [esi + 4], 0
and dword [esi + 8], 0
xor eax, eax
pop esi
ret

Function at 0x300162cd
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x30034be8]
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [0x300069c0]
mov dword [ebp - 0xc], eax
mov eax, dword [0x300069c4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 4]
call fcn.3001f57d
leave
ret 8
Function at 0x30017e64
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
cmp word [0x30077220], di
mov dword [ebp - 8], edi
mov esi, 0x30077220
jne 0x30017e8d
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 8]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x30017ed2
push 0x30008190
call fcn.3000ff32
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
call esi
test eax, eax
jg 0x30017ebd
call esi
mov edi, eax
jmp 0x30017f69
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x30017f69
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x30017f11
push 0x30008118
call fcn.3000ff32
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
call esi
test eax, eax
jg 0x30017eff
call esi
mov edi, eax
jmp 0x30017f5a
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x30017f5a
push eax
push ebx
push dword [ebp - 8]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x30017f4f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x300080e0
push dword [ebp - 4]
mov dword [ebp - 0x10], 4
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
push eax
push 0x300080c0
call fcn.3000ff32
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x30017f69
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x30018c26
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
xor esi, esi
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.3000cc94
lea ecx, [ebp - 0xc]
call fcn.3000cc94
push 0x11
xor eax, eax
pop ecx
push dword [ebp + 8]
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or dword [ebp - 0x20], 0xffffffff
or dword [ebp - 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xc]
call fcn.3000cd95
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.3000ce85
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [0x3007bd2c]
push dword [ebp + 0xc]
call fcn.3001812a
cmp eax, esi
mov dword [ebp - 4], eax
je 0x30018cae
push 0x30008958
call fcn.3000ff32
pop ecx
jmp 0x30018d7d
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push 0x300088e8
call fcn.3000ff32
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
add esp, 0xc
mov dword [ebp + 8], esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x30056468
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x30018d18
call ebx
push 0x64
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0x653
jne 0x30018d7c
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x14
jl 0x30018cd1
jmp 0x30018d7c
push 0x300088ac
call fcn.3000fe20
push 0xff
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x24]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x30018d77
cmp dword [ebp - 4], 0x103
jne 0x30018d04
jmp 0x30018d66
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push esi
push esi
lea eax, [ebp - 0x40]
push esi
push eax
call edi
test eax, eax
jne 0x30018d52
jmp 0x30018d22
call ebx
mov dword [ebp - 4], eax
pop ebx
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.3000cc9e
lea ecx, [ebp - 0x14]
call fcn.3000cc9e
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x30018d98
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 0x480c
lea ebp, [esp - 0x478c]
call fcn.3001f58a
mov eax, dword [0x30034be8]
push ebx
push esi
xor ebx, ebx
push ebx
mov dword [ebp + 0x4788], eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 0x4794]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
jne 0x30018e29
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x30018df8
call esi
mov esi, eax
jmp 0x30018e08
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jge 0x30018e29
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008a38
call fcn.3000fdf9
add esp, 0xc
jmp 0x30018f8c
push edi
xor eax, eax
mov ecx, 0x800
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x7fe
jmp 0x30018f26
mov eax, dword [ebp - 0x80]
cmp eax, ebx
jbe 0x30018f7c
mov byte [ebp + eax + 0x3f88], bl
mov byte [ebp + eax + 0x3f89], bl
lea eax, [ebp + 0x3f88]
push eax
push 0x1000
lea eax, [ebp - 0x78]
push eax
call fcn.3000ce53
mov esi, eax
cmp esi, ebx
jl 0x30018f40
lea esi, [ebp - 0x78]
push 0x30008a30
mov eax, esi
push eax
jmp 0x30018ecc
push 0x300088a0
mov word [edi], bx
push esi
add edi, 4
call dword [sym.imp.MSVCRT.dll_wcsstr]
cmp eax, ebx
pop ecx
pop ecx
je 0x30018ec4
push dword [ebp + 0x47a0]
push dword [ebp + 0x479c]
push dword [ebp + 0x4798]
push eax
call fcn.3001886c
mov esi, eax
cmp esi, ebx
jl 0x30018f52
push 0x30008a30
mov esi, edi
push edi
call dword [sym.imp.MSVCRT.dll_wcsstr]
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x30018e8a
push esi
mov edi, 0x1000
push edi
lea eax, [ebp + 0x1f88]
push eax
call fcn.3000cd1d
mov esi, eax
cmp esi, ebx
jl 0x30018f64
lea eax, [ebp + 0x1f88]
push eax
push edi
lea eax, [ebp - 0x78]
push eax
call fcn.3000cd1d
mov esi, eax
cmp esi, ebx
jl 0x30018f64
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
je 0x30018f19
inc eax
push ebx
lea ecx, [ebp - 0x80]
push ecx
mov ecx, 0x7fe
sub ecx, eax
push ecx
lea eax, [ebp + 0x3f88]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x30018e45
jmp 0x30018f7c
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008a24
jmp 0x30018f74
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008a04
jmp 0x30018f74
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008894
call fcn.3000fdf9
add esp, 0xc
cmp dword [ebp - 0x7c], 0xffffffff
pop edi
je 0x30018f8c
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x4788]
mov eax, esi
pop esi
pop ebx
call fcn.3001f57d
add ebp, 0x478c
leave
ret 0x10
Function at 0x30019298
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x30034be8]
push esi
push edi
mov dword [ebp + 0x190], eax
lea eax, [ebp - 0x74]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 0x19c]
mov dword [ebp - 0x74], edi
push dword [0x300341b8]
mov dword [ebp - 0x78], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
jne 0x300192e2
xor eax, eax
jmp 0x30019339
cmp esi, edi
je 0x300192f3
push 0x30008f70
call fcn.3000fdf9
pop ecx
jmp 0x3001932c
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, edi
jne 0x3001932c
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp esi, edi
je 0x300192f3
mov eax, esi
sub eax, 0x103
neg eax
sbb eax, eax
and eax, esi
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
call fcn.3001f57d
add ebp, 0x194
leave
ret 4

Function at 0x30019350
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x30034be8]
push esi
push edi
mov dword [ebp + 0x190], eax
lea eax, [ebp - 0x74]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 0x19c]
push dword [0x300341b8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
jne 0x30019394
xor esi, esi
jmp 0x300193e1
cmp esi, edi
jne 0x300193e1
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x300193d3
push dword [ebp + 0x19c]
push dword [0x300341b8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp dword [ebp - 0x74], edi
je 0x300193e1
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x190]
pop edi
mov eax, esi
pop esi
call fcn.3001f57d
add ebp, 0x194
leave
ret 4
Function at 0x30019474
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x30034be8]
push esi
mov dword [ebp - 4], eax
push 0x30008d18
lea eax, [ebp - 0x24]
push eax
call fcn.300193fa
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x20], eax
je 0x300194a7
push 0x300038dc
call fcn.3000fdf9
pop ecx
jmp 0x30019525
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [eax], esi
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0x16
call edi
mov dword [ebp - 0x2c], 1
mov ebx, 0x103
jmp 0x30019519
cmp dword [ebp - 0x20], esi
jne 0x30019523
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
pop ecx
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx]
jl 0x300194f8
inc eax
mov dword [ecx], eax
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0x28], 0x16
push dword [ebp - 0x24]
call edi
inc dword [ebp - 0x2c]
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x300194de
mov dword [ebp - 0x20], esi
pop edi
pop ebx
cmp dword [ebp - 0x24], esi
pop esi
je 0x30019534
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.3001f57d
leave
ret 4

Function at 0x30019543
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x30034be8]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.300193fa
xor ebx, ebx
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x30019577
push 0x300038dc
call fcn.3000fdf9
pop ecx
jmp 0x30019623
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
mov dword [eax], 0xfffffc18
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x20]
mov dword [ebp - 0x28], 0x16
call esi
mov dword [ebp - 0x24], 1
mov edi, 0x103
jmp 0x300195f6
cmp dword [ebp + 0xc], ebx
jne 0x30019616
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
mov edx, dword [ebp + 8]
pop ecx
mov ecx, dword [edx]
cmp eax, ecx
jl 0x300195d3
cmp ecx, 0xfffffc18
jne 0x300195d5
mov dword [edx], eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0x16
push dword [ebp - 0x20]
call esi
inc dword [ebp - 0x24]
cmp eax, edi
mov dword [ebp + 0xc], eax
jne 0x300195b2
mov eax, dword [ebp + 8]
cmp dword [eax], 0xfffffc18
jne 0x30019611
mov dword [ebp + 0xc], 0xfffffe0c
jmp 0x30019621
mov dword [ebp + 0xc], ebx
jmp 0x30019621
push 0x30008009
call fcn.3000fdf9
pop ecx
pop edi
pop esi
cmp dword [ebp - 0x20], ebx
pop ebx
je 0x30019632
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.3001f57d
leave
ret 8
Function at 0x30019641
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x30034be8]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [esi], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x300196a9
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x20]
mov dword [ebp + 8], 0x16
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push dword [ebp - 0x20]
mov edi, eax
xor eax, eax
cmp edi, ebx
sete al
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 2
je 0x300196ba
cmp edi, 0x103
je 0x300196ba
mov eax, edi
jmp 0x300196bc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 0xc

Function at 0x300196cb
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x30034be8]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jle 0x30019798
cmp word [esi + 2], 0x3a
jne 0x30019798
xor eax, eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [esi]
mov word [ebp - 0xc], ax
mov ax, word [esi + 4]
xor ebx, ebx
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], ax
mov dword [ebp + 8], ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x30019778
push ebx
push ebx
push ebx
push ebx
xor eax, eax
push ebx
mov word [ebp - 0x218], bx
mov ecx, 0x82
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x300197a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30008f98
call fcn.3000ff32
pop ecx
pop ecx
jmp 0x30019784
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x300197a9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 5
jl 0x3001971f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 4
xor eax, eax
inc eax
jmp 0x3001979a
Function at 0x30019959
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
and dword [ebx], 0
push esi
lea eax, [ebp + 0xc]
push eax
push 1
push 0
push 0x30008d18
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x300199bf
mov eax, dword [ebp + 8]
xor ecx, ecx
sub eax, ecx
mov dword [ebp + 0x10], 4
je 0x3001999a
dec eax
jne 0x3001999f
mov ecx, 0x30008e08
jmp 0x3001999f
mov ecx, 0x30008df0
lea eax, [ebp + 0x10]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push 0
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
dec eax
dec eax
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x300199cf
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x30008d18
push dword [0x300341b8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x30019a3d
mov eax, dword [ebp + 8]
xor ecx, ecx
sub eax, ecx
je 0x30019a06
dec eax
jne 0x30019a0b
mov ecx, 0x30008e08
jmp 0x30019a0b
mov ecx, 0x30008df0
cmp dword [ebp + 0xc], 0
je 0x30019a28
push 4
push 0x3000444c
push 1
push 0
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x30019a32
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
dec eax
dec eax
neg eax
sbb eax, eax
and eax, esi
pop esi
leave
ret 8

Function at 0x30019ab6
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
xor ebx, ebx
call fcn.300104cb
cmp dword [0x30034130], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x30019b49
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x30019af9
call esi
mov ebx, eax
cmp ebx, edi
jne 0x30019b62
lea eax, [ebp - 0x10]
push eax
push 0x3000906c
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x30019b15
call esi
mov ebx, eax
cmp ebx, edi
jne 0x30019b62
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x30019b40
call esi
mov ebx, eax
cmp ebx, edi
jne 0x30019b62
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80040004
push 1
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x30019b62
call esi
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x3001a20f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x30034be8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
mov eax, dword [esi]
push 0x30009820
push eax
call fcn.30015b03
test eax, eax
jne 0x3001a317
mov eax, dword [esi]
push 0x30009810
push eax
call fcn.30015b03
test eax, eax
jne 0x3001a317
mov eax, dword [esi]
push 0x30001608
push eax
call fcn.30015b03
test eax, eax
jne 0x3001a317
cmp dword [ebp + 0x10], eax
jne 0x3001a317
mov esi, dword [esi]
and word [ebp - 0x210], ax
push 0x2f
push esi
call fcn.30015a7f
mov esi, eax
test esi, esi
je 0x3001a317
mov edi, 0x105
inc esi
inc esi
mov ax, word [esi]
cmp ax, 0x69
je 0x3001a2c2
cmp ax, 0x49
je 0x3001a2c2
cmp ax, 0x61
je 0x3001a2c2
cmp ax, 0x41
je 0x3001a2c2
cmp ax, 0x78
je 0x3001a2c2
cmp ax, 0x58
je 0x3001a2c2
cmp ax, 0x6a
je 0x3001a2ce
cmp ax, 0x4a
jne 0x3001a305
cmp ax, 0x6a
je 0x3001a2ce
cmp ax, 0x4a
jne 0x3001a2d0
inc esi
inc esi
inc esi
inc esi
mov ax, word [esi]
cmp ax, 0x66
je 0x3001a2e1
cmp ax, 0x46
jne 0x3001a2f3
mov ax, word [esi]
cmp ax, 0x20
je 0x3001a2ef
test ax, ax
je 0x3001a2f3
inc esi
inc esi
jmp 0x3001a2e1
push edi
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.30012ddf
test eax, eax
jne 0x3001a328
push 0x2f
push esi
call fcn.30015a7f
mov esi, eax
test esi, esi
jne 0x3001a28d
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.3001f57d
leave
ret 0xc
push 0x300097c0
call fcn.3000fe20
lea eax, [ebp - 0x210]
push eax
call fcn.3000dce2
test eax, eax
je 0x3001a34e
push 0x30009778
call fcn.3000ff32
jmp 0x3001a36a
cmp word [ebp - 0x210], 0x7b
lea eax, [ebp - 0x210]
push eax
jne 0x3001a36d
push 0x30009728
call fcn.3000ff32
pop ecx
pop ecx
jmp 0x3001a317
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call esi
cmp eax, 0xffffffff
jne 0x3001a317
lea eax, [ebp - 0x210]
push eax
call fcn.300196cb
jmp 0x3001a40b
xor eax, eax
cmp dword [0x30077198], eax
jne 0x3001a42b
cmp dword [0x30077190], eax
jne 0x3001a42b
cmp dword [0x30077194], eax
jne 0x3001a42b
push edi
lea eax, [ebp - 0x628]
push eax
push 0x4d
call fcn.3000ffad
test eax, eax
je 0x3001a422
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x41c]
push edi
push eax
call fcn.3000d759
mov dword [0x30076cfc], eax
add esp, 0x10
lea eax, [ebp - 0x41c]
push eax
call fcn.3000fe20
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push 0x11
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x3001a43e
lea eax, [ebp - 0x210]
push eax
call esi
cmp eax, 0xffffffff
je 0x3001a38b
jmp 0x3001a317
push 0x4d
push 0x300096e0
jmp 0x3001a437
lea eax, [ebp - 0x210]
push eax
push 0x300096ac
call fcn.3000ff32
pop ecx
pop ecx
xor eax, eax
jmp 0x3001a31a
Function at 0x3001ba22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x3007bd48], 0
jne 0x3001ba9e
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x3000a888
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x3007bd44
lea eax, [ebp - 0xc]
push eax
push 0
push 0x3000a8dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x3001ba82
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x3001ba8b
and dword [0x3007bd44], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x3007bd48], 1
leave
ret

Function at 0x3001c2fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push 0x14
pop edx
mov ecx, edx
mov esi, 0x3000afa0
lea edi, [ebp - 0x270]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
xor eax, eax
push 0x6d
pop ecx
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x18], bx
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x27
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x274], ebx
call fcn.3001c4bb
test eax, eax
je 0x3001c44f
lea eax, [ebp - 0x68]
push eax
push 0x104
lea eax, [ebp - 0x270]
push eax
call fcn.3000ce53
cmp eax, ebx
jge 0x3001c39d
push eax
push 0x30001400
call fcn.3000fdf9
push 0x3000af68
call fcn.3000fdf9
add esp, 0xc
jmp 0x3001c44f
lea eax, [ebp - 0x274]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x270]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov edi, 0xffff
mov esi, 0x80070000
mov ecx, eax
jle 0x3001c3d0
and ecx, edi
or ecx, esi
cmp ecx, ebx
jge 0x3001c3ee
cmp eax, ebx
jle 0x3001c3dc
and eax, edi
or eax, esi
push eax
push 0x30001400
call fcn.3000fdf9
push 0x3000af40
jmp 0x3001c390
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x3000af30
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov ecx, eax
jle 0x3001c416
and ecx, edi
or ecx, esi
cmp ecx, ebx
jge 0x3001c437
cmp eax, ebx
jle 0x3001c422
and eax, edi
or eax, esi
push eax
push 0x30001400
call fcn.3000fdf9
push 0x3000aefc
jmp 0x3001c390
cmp word [ebp - 0x18], 0x31
je 0x3001c445
cmp word [ebp - 0x18], 0x32
jne 0x3001c44f
mov dword [ebp - 0x278], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x278]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret