joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3004bf26
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0x3004bf3e
xor eax, eax
jmp 0x3004c0b5
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
je 0x3004bf56
push eax
call fcn.3005ba5a
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ebx
push edi
or edi, 0xffffffff
cmp dword [ebp - 8], ebx
jne 0x3004bf73
cmp dword [0x300cba9c], ebx
je 0x3004bf81
mov dword [ebp - 0x1c], 2
jmp 0x3004bf8e
cmp dword [ebp - 8], 1
jne 0x3004bf81
cmp dword [0x300ccaa4], ebx
je 0x3004bf8b
test byte [esi + 0xc], 0x10
je 0x3004c04f
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x10], ebx
call fcn.3004ad3c
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
jmp 0x3004c017
mov eax, dword [ebp - 0xc]
cmp eax, ebx
mov esi, dword [ebp - 0x10]
jne 0x3004bfb6
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
mov edi, eax
jae 0x3004bfe1
cmp dword [ebp - 0x14], 1
je 0x3004bfde
cmp dword [ebp - 0x14], 2
jne 0x3004bfe1
push 2
pop edi
push edi
call fcn.3004a95a
test eax, eax
pop ecx
je 0x3004c02a
push 0x796d746f
push ebx
call fcn.300434f7
push esi
mov ecx, 0x300cbaa8
call fcn.3004aeda
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.3004af9c
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x3004bfaa
jmp 0x3004c039
push esi
mov ecx, 0x300cbaa8
call fcn.3004ae58
cmp edi, ebx
je 0x3004c05e
cmp dword [0x300cbaa4], ebx
je 0x3004c04c
push 0x300cb5c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 8]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x3004bf5a
jmp 0x3004c071
cmp dword [0x300cbaa4], ebx
je 0x3004c075
push 0x300cb5c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, ebx
jne 0x3004c095
cmp dword [ebp - 0x14], 2
je 0x3004c087
mov eax, dword [ebp + 8]
mov al, byte [eax + 0xc]
and al, 0xf
cmp al, 2
jne 0x3004c095
push dword [ebp - 4]
call fcn.3004ab7b
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 0x18], ebx
je 0x3004c0a2
push dword [ebp - 0x18]
call fcn.300431db
cmp edi, ebx
pop edi
je 0x3004c0b2
push dword [ebp + 8]
call fcn.3004ab96
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x3004ca96
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call fcn.30046182
test eax, eax
jne 0x3004cab3
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
push ebx
push esi
push edi
push eax
push 0x11
call fcn.30045cc5
push dword [ebp - 0x1c]
push 0x12
call fcn.30045cc5
push 0x3000a628
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x3004cbb5
push 0x3000a608
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x3004cbb5
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x3004cbb5
push dword [ebp - 4]
call fcn.30042ff1
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x3004cbad
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
je 0x3004cbad
mov eax, dword [ebp - 4]
push 0x18
xor edx, edx
pop ecx
div ecx
xor ebx, ebx
and dword [ebp - 8], ebx
xor esi, esi
test eax, eax
jbe 0x3004cbad
mov edx, edi
mov edi, eax
mov eax, dword [edx + 4]
sub eax, 0
je 0x3004cb65
dec eax
dec eax
jne 0x3004cb76
push dword [edx]
call fcn.3004c3a3
cmp ebx, eax
pop ecx
ja 0x3004cb76
mov ebx, eax
jmp 0x3004cb76
push dword [edx]
inc dword [ebp - 8]
call fcn.3004c3a3
cmp esi, eax
pop ecx
ja 0x3004cb76
mov esi, eax
add edx, 0x18
dec edi
jne 0x3004cb49
test esi, esi
je 0x3004cb8b
push esi
push 0x19e1
call fcn.30045cc5
test ebx, ebx
je 0x3004cb9a
push ebx
push 0x19e2
call fcn.30045cc5
cmp dword [ebp - 8], 0
je 0x3004cbad
push dword [ebp - 8]
push 0x19e0
call fcn.30045cc5
push dword [ebp - 0xc]
call fcn.3004304e
xor esi, esi
cmp dword [ebp - 0x1c], esi
ja 0x3004cbd0
push esi
push 0x72766c74
call fcn.300434a3
cmp dword [ebp - 0x1c], esi
jbe 0x3004cc63
push 0x3000a5ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
jne 0x3004cbe9
push esi
push 0x3366646b
jmp 0x3004cc01
push 0x3000a5d4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x3004cc08
push eax
push 0x3366646c
call fcn.300434a3
jmp 0x3004cc58
mov eax, dword [ebp - 0x1c]
push 0x18
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call fcn.30042ff1
mov esi, eax
test esi, esi
je 0x3004cc58
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x18
push eax
push esi
push 0
push 0
push 0xb
call edi
test eax, eax
je 0x3004cc47
push 0
push 0x72766c76
call fcn.300434a3
jmp 0x3004cc51
push dword [esi + 4]
push 0x10
call fcn.30045cc5
push esi
call fcn.30025734
pop ecx
test ebx, ebx
je 0x3004cc63
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3004cccb
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], esi
xor ebx, ebx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov word [ebp - 0x20c], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x3004cd80
push esi
push 0x33753467
call fcn.300434a3
mov edi, 0x3a98
push edi
push 0xfa1
call fcn.30045cc5
push edi
push 0xfa2
call fcn.30045cc5
push edi
push 0xfa3
call fcn.30045cc5
push edi
push 0xfa4
call fcn.30045cc5
cmp ebx, esi
je 0x3004cd71
push ebx
call fcn.30025734
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3006961b
leave
ret
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.30064c50
mov edi, eax
cmp edi, esi
je 0x3004cd35
push edi
call fcn.30042ff1
mov ebx, eax
cmp ebx, esi
jne 0x3004cdad
push esi
push 0x33753468
jmp 0x3004cd30
push ebx
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.30064c56
test eax, eax
jne 0x3004cdcb
push esi
push 0x33753469
jmp 0x3004cd30
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x30003940
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x3004cdf3
push esi
push 0x3375346a
jmp 0x3004cd30
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xa]
push eax
push 0xfa1
call fcn.30045cc5
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 8]
push eax
push 0xfa2
call fcn.30045cc5
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xe]
push eax
push 0xfa3
call fcn.30045cc5
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xc]
push eax
jmp 0x3004cd5c

Function at 0x3004d14b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x3004d1ec
cmp dword [ebp - 0x90], 2
mov edx, dword [ebp - 0x98]
mov dword [0x300cb5e0], edx
jne 0x3004d1e0
mov eax, dword [ebp - 0x9c]
cmp eax, 5
mov cx, word [ebp - 0xc]
mov dword [0x300cb5dc], eax
mov word [0x300cb5e4], cx
jne 0x3004d1ca
xor eax, eax
inc eax
cmp edx, eax
jb 0x3004d1ec
test cx, cx
mov dword [0x300cb5e8], eax
ja 0x3004d1be
cmp edx, eax
jbe 0x3004d1c3
mov dword [0x300cb5ec], eax
cmp cx, ax
jbe 0x3004d1ec
jmp 0x3004d1d9
jbe 0x3004d1ec
xor eax, eax
inc eax
mov dword [0x300cb5e8], eax
mov dword [0x300cb5ec], eax
mov dword [0x300cb5f0], eax
jmp 0x3004d1ec
push 0
push 0x77617376
call fcn.300434a3
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
xor ecx, ebp
mov dword [section..data], eax
call fcn.3006961b
leave
ret
Function at 0x3004d3bf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x300ccab0], 0
je 0x3004d3e2
mov eax, dword [0x300ccaac]
jmp 0x3004d461
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
je 0x3004d41e
test byte [ebp - 8], 0x10
je 0x3004d41e
xor eax, eax
inc eax
jmp 0x3004d451
mov ecx, dword [0x300cb5dc]
xor eax, eax
cmp ecx, 5
mov dword [0x300ccaac], eax
jg 0x3004d43a
jne 0x3004d456
cmp dword [0x300cb5e0], eax
jbe 0x3004d456
lea eax, [ebp - 0xa0]
push eax
call esi
test eax, eax
je 0x3004d44f
test word [ebp - 8], 0x100
jne 0x3004d419
xor eax, eax
mov dword [0x300ccaac], eax
mov dword [0x300ccab0], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3006961b
leave
ret

Function at 0x30059d82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059e0d
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059dc0
cmp byte [eax], 0
je 0x30059e04
lea eax, [eax + 1]
test eax, 3
je 0x30059dc0
cmp byte [eax], 0
je 0x30059e04
lea eax, [eax + 1]
test eax, 3
je 0x30059dc0
cmp byte [eax], 0
je 0x30059e04
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x30059dc0
test cl, cl
lea eax, [eax - 4]
je 0x30059e04
test ecx, 0xff00
lea eax, [eax + 1]
je 0x30059e04
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x30059e04
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x30059e04
lea eax, [eax + 1]
jmp 0x30059dc0
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x30059e13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059e85
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059e44
cmp word [eax], 0
je 0x30059e3d
lea eax, [eax + 2]
test eax, 3
je 0x30059e44
jmp 0x30059e2b
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30059e7f
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x30059e44
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30059e7f
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30059e7f
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x30059e44
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x3005eac9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3005eae3
test al, 0x10
je 0x3005eae3
xor eax, eax
inc eax
jmp 0x3005eae5
xor eax, eax
pop ebp
ret 4

Function at 0x30060340
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call dword [sym.imp.MSVCR80.dll__vsnprintf]
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3006961b
leave
ret

Function at 0x30063acd
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x300cd684
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x30063b1e
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x300cd688], eax
mov ax, word [ebp - 0x30]
mov word [0x300cd68c], ax
mov eax, dword [ebp - 0x18]
mov dword [0x300cd690], eax
mov eax, dword [ebp - 0x40]
mov dword [0x300cd694], eax
mov eax, esi
pop esi
leave
ret

Function at 0x300667e9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x300cd754], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x30066812
mov edi, 0x8ff000ff
jmp 0x30066857
test ebx, ebx
je 0x30066852
call fcn.30066048
mov edi, eax
test edi, edi
jl 0x30066857
push esi
call fcn.30064fbd
mov esi, eax
test esi, esi
je 0x30066852
test byte [esi + 0x1f], 4
jne 0x30066849
push esi
call fcn.30065be5
mov edi, eax
test edi, edi
jge 0x30066849
cmp edi, 0x8007000e
je 0x30066857
xor edi, edi
mov eax, dword [ebp + 0xc]
dec eax
je 0x3006686a
dec eax
je 0x30066882
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3006961b
leave
ret 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x30066882
cmp byte [esi + 0x1e], 0
jbe 0x30066882
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x30066857
cmp dword [esi + 8], 0x1000
jne 0x300668a9
call fcn.300691a0
test al, al
je 0x300668a9
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 4]
call fcn.30069142
jmp 0x300668bd
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x30066852
lea eax, [ebp - 0xc]
push eax
call fcn.30064fa5
push ebx
push eax
call fcn.30065f94
mov edi, eax
jmp 0x30066857
Function at 0x300668d5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x300cd73c
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [esi + 0x1f], 2
jne 0x30066aea
mov eax, dword [esi + 0x14]
cmp eax, ebx
push edi
mov edi, 0x300cd778
je 0x3006692b
push eax
mov ecx, edi
call fcn.30068fa2
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x30066a2c
lea eax, [ebp - 0x23c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x3002216c
push ebx
call fcn.30067e2e
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x30066a2c
mov eax, dword [ebp - 0x238]
push 4
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or eax, ecx
push eax
mov ecx, edi
call fcn.30068f78
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x30066a3c
cmp dword [ebp - 0x238], ebx
mov dword [ebp - 0x21c], ebx
jbe 0x30066a00
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x23c]
push dword [eax + ecx*4]
call fcn.300662d1
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x300669e5
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x224]
mov dword [ecx + eax*4], edx
inc byte [esi + 0x1d]
jmp 0x300669ec
cmp eax, 0x8007000e
je 0x30066a17
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x238]
jb 0x300669ab
cmp byte [esi + 0x1d], bl
jne 0x30066ad6
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
jmp 0x30066ad6
push dword [esi + 0x14]
mov ecx, edi
call fcn.30068fa2
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
jmp 0x30066ae9
push 4
mov ecx, edi
call fcn.30068f78
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x30066a4b
mov dword [ebp - 0x218], 0x8007000e
jmp 0x30066ae9
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
call fcn.300691a0
test al, al
je 0x30066a7b
cmp dword [esi + 8], 0x1000
jne 0x30066a7b
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 4]
call fcn.30069142
jmp 0x30066a92
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x30066ad6
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], ebx
call fcn.30065025
test eax, eax
je 0x30066aca
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.3006828f
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x30066ae9
cmp dword [esi + 8], 0xc00
je 0x30066ae3
or byte [esi + 0x1f], 2
mov dword [ebp - 0x218], ebx
pop edi
push 0x300cd73c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], ebx
pop esi
pop ebx
je 0x30066b0b
lea eax, [ebp - 0x23c]
push eax
call fcn.30067e9b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.3006961b
leave
ret 4
Function at 0x300691a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x300cd787], 0
jne 0x300691fa
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x300691f3
cmp dword [ebp - 0x110], 2
jne 0x300691f3
cmp dword [ebp - 0x11c], 6
jb 0x300691f3
call fcn.30069055
mov byte [0x300cd786], al
mov byte [0x300cd787], 1
mov ecx, dword [ebp - 4]
mov al, byte [0x300cd786]
xor ecx, ebp
call fcn.3006961b
leave
ret

Function at 0x30069567
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x30022240
push 0x3000a628
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x3006959c
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x3002223c
push ebx
call edi
test esi, esi
mov dword [0x3002223c], esi
jne 0x30069600
mov dword [0x3002223c], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x300bcb40], 0x44bf19b1
pop ebx
leave
ret
Function at 0x3006961b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3002223c]
jne 0x3006a33f
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x300cd8f0], eax
mov dword [0x300cd8ec], ecx
mov dword [0x300cd8e8], edx
mov dword [0x300cd8e4], ebx
mov dword [0x300cd8e0], esi
mov dword [0x300cd8dc], edi
mov word [0x300cd908], ss
mov word [0x300cd8fc], cs
mov word [0x300cd8d8], ds
mov word [0x300cd8d4], es
mov word [0x300cd8d0], fs
mov word [0x300cd8cc], gs
pushfd
pop dword [0x300cd900]
mov eax, dword [ebp]
mov dword [0x300cd8f4], eax
mov eax, dword [ebp + 4]
mov dword [0x300cd8f8], eax
lea eax, [ebp + 8]
mov dword [0x300cd904], eax
mov eax, dword [ebp - 0x320]
mov dword [0x300cd840], 0x10001
mov eax, dword [0x300cd8f8]
mov dword [0x300cd7f4], eax
mov dword [0x300cd7e8], 0xc0000409
mov dword [0x300cd7ec], 1
mov eax, dword [0x3002223c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x300bcb40]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x300cd838], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x30022510
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x300cd838], 0
jne 0x3006a42f
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x30069633
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x30005b54
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3006968b
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push 0x30005b4c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3006968b
mov al, 1
jmp 0x3006968d
xor al, al
leave
ret 8
Function at 0x30069ec5
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x30088760
call fcn.30069edb
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300cec78
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30069c64
cmp eax, esi
jne 0x30069c57
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30069c67
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30069c3e
xor esi, esi
inc esi
mov eax, dword [0x300cec74]
cmp eax, esi
jne 0x30069c7a
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30069ca9
mov eax, dword [0x300cec74]
test eax, eax
jne 0x30069ca3
mov dword [0x300cec74], esi
push 0x3000169c
push 0x30001690
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30069ca9
jmp 0x30069dd1
mov dword [0x300cd7e0], esi
mov eax, dword [0x300cec74]
cmp eax, esi
jne 0x30069ccd
push 0x3000168c
push 0x30001674
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300cec74], 2
test ebx, ebx
jne 0x30069cd9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300cec84], 0
je 0x30069cfd
push 0x300cec84
call fcn.3006a502
pop ecx
test eax, eax
je 0x30069cfd
push 0
push 2
push 0
call dword [0x300cec84]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30069d59
test al, al
je 0x30069d17
cmp dword [ebp - 0x1c], 0
jne 0x30069d59
mov al, byte [esi]
test al, al
je 0x30069d27
cmp al, 0x20
ja 0x30069d27
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30069d17
test byte [ebp - 0x3c], 1
je 0x30069d33
movzx eax, word [ebp - 0x38]
jmp 0x30069d36
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x300cd7dc], eax
cmp dword [0x300cd7d0], 0
jne 0x30069dad
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30069d68
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30069d7b
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30069d04
cmp dword [0x300cd7e0], 0
jne 0x30069dbc
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x300cd7dc]
jmp 0x30069ddd
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30069f20
ret
call fcn.30069567
jmp 0x30069c04