joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3001536c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x3004003c], 0
je 0x300153cd
cmp word [0x30040210], 0xd7b2
jne 0x30015395
cmp dword [0x30040218], 0
jbe 0x30015395
mov eax, 0x3004020c
call dword [0x30040228]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x3003f05c
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x300153f4
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x3003f020], 0
jne 0x300153e9
push 0
push 0x3003f054
push 0x3003f05c
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret

Function at 0x30016378
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x300163de
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.30015730
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.300146f4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x300163c8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x300163e5
lea eax, [ebp - 0x10]
call fcn.300154e8
ret

Function at 0x30017604
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x300176a0
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.30015a30
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.300159a0
lea edx, [ebp + 0x30]
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x3001762c
cmp byte [esp], 0
je 0x30017671
mov eax, edi
call fcn.300159a0
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x300176ac
mov eax, edi
call fcn.300159a0
push eax
mov eax, edi
call fcn.300159a0
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.300145cc
mov edx, ebx
mov eax, edi
call fcn.30015a30
jmp 0x300176ac
mov eax, edi
mov edx, 0x300176bc
call fcn.3001553c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x30017d04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.30015938
xor eax, eax
push ebp
push 0x30017d66
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.3001553c
mov eax, ebx
call fcn.30015998
mov eax, dword [ebx]
call fcn.30015748
test eax, eax
jle 0x30017d50
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x30017d45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30017d6d
lea eax, [ebp - 4]
call fcn.300154e8
ret
Function at 0x300184cc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x30018514
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.KERNEL32.dll_IsBadReadPtr
test eax, eax
jne 0x3001850a
cmp word [edi], 0x5a4d
jne 0x3001850a
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x3001850a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x30018520
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x300186b0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x300186f6
push 0x20a
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
push 0x104
push ebx
push esi
call sub.KERNEL32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
jmp 0x30018727
push 0x105
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
push 0x104
push ebx
push esi
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
push ebx
call sub.KERNEL32.dll_LocalFree
cmp esi, 0xffffffff
je 0x30018784
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x30018752
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x30018764
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x3001877e
push 0
push 0
push 0
push 4
push ebx
call sub.KERNEL32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.KERNEL32.dll_CloseHandle
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x3001b908
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.KERNEL32.dll_VirtualQuery
cmp eax, 0x1c
jne 0x3001b984
cmp dword [esp + 0x10], 0x1000
jne 0x3001b984
cmp dword [esp + 4], 0
je 0x3001b984
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
je 0x3001b984
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x3001b984
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x3001b984
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x3001e5f4
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
cmp dword [0x3003fba4], 0xffffffff
jne 0x3001e643
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x3001e63c
mov eax, esp
mov edx, 0x114
call fcn.30016b80
mov dword [esp], 0x114
mov eax, esp
push eax
call sub.KERNEL32.dll_GetVersionExW
cmp dword [esp + 4], 6
setae al
and eax, 0x7f
mov dword [0x3003fba4], eax
jmp 0x3001e643
xor eax, eax
mov dword [0x3003fba4], eax
cmp dword [0x3003fba4], 1
sete al
add esp, 0x114
ret

Function at 0x3001f030
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x3001f0e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, 0x3001f100
call fcn.30017d04
push dword [ebp - 0xc]
push 0x3001f114
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov cl, byte [ebp - 1]
mov eax, 0x3001f120
call fcn.3001eef4
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.30015808
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
call fcn.30015948
push eax
call fcn.3001ec0c
mov esi, eax
test esi, esi
je 0x3001f0cc
push 0
push 0
push 0
push 4
push esi
call sub.KERNEL32.dll_MapViewOfFile
test eax, eax
je 0x3001f0c6
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3001f0ee
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.3001550c
ret

Function at 0x3001f378
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor esi, esi
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x3001f3e9
mov ebx, 0x5f040000
jmp 0x3001f3d7
cmp dword [esp + 0x10], 0x10000
jne 0x3001f3b5
push 0x40
push 0x2000
push edi
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
jmp 0x3001f3e9
cmp dword [esp + 0xc], 0x10000
jae 0x3001f3c9
mov dword [esp + 0xc], 0x10000
jmp 0x3001f3d1
and dword [esp + 0xc], 0xffff0000
mov eax, dword [esp + 0xc]
add ebx, eax
push 0x1c
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_VirtualQuery
cmp eax, 0x1c
je 0x3001f395
push 0x40
push 0x1000
push edi
push esi
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x3001f6b4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x3003fb90]
cmp eax, 0x1c
jne 0x3001f72f
cmp dword [ebp - 0xc], 0x1000
jne 0x3001f72a
cmp dword [ebp - 0x18], 0
je 0x3001f72a
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x3001f72a
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x3001f709
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x3001f72f
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x3003fb60]
cmp eax, 0
je 0x3001f72a
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x3003fbbc]
add ebx, dword [ebp - 0x10]
jmp 0x3001f6cb
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x300232fc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x300234e3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 0x300234fc
call fcn.3001b770
mov dword [0x300408e8], eax
xor edx, edx
mov eax, 0x30023520
call fcn.3001b770
mov dword [0x300408ec], eax
lea eax, [ebp - 8]
mov edx, 5
call fcn.30015a30
lea eax, [ebp - 8]
call fcn.300159a0
mov byte [eax], 0x72
lea eax, [ebp - 8]
call fcn.300159a0
mov byte [eax + 1], 0x64
lea eax, [ebp - 8]
call fcn.300159a0
mov byte [eax + 2], 0x65
lea eax, [ebp - 8]
call fcn.300159a0
mov byte [eax + 3], 0x63
lea eax, [ebp - 8]
call fcn.300159a0
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, 0x30023548
call fcn.30017d04
push dword [ebp - 0xc]
push 0x30023558
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.30017998
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 4
call fcn.30015808
mov eax, dword [ebp - 8]
call fcn.30015948
push eax
push 0
push 0
call fcn.30016808
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x300234c8
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [0x300408dc], esi
mov dword [0x300408e0], edi
cmp dword [0x300408e8], 0
je 0x30023418
cmp dword [0x300408ec], 0
jne 0x3002349a
mov dl, 1
mov eax, 0x30023564
call fcn.3001b86c
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x300234ac
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x300234ac
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x300234ac
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x300234ac
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x300234ac
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x300234ac
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x300408e4], edx
mov edx, 0x300232ac
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 4]
push edx
push 4
push eax
call sub.KERNEL32.dll_VirtualProtect
mov bl, 1
jmp 0x300234ac
push 0x30023258
push 1
call dword [0x300408e8]
test eax, eax
setne bl
test bl, bl
jne 0x300234c8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x300234ea
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.3001550c
ret
Function at 0x30023580
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x300408e8], 0
je 0x30023598
cmp dword [0x300408ec], 0
jne 0x300235f1
mov dl, 1
mov eax, 0x3002360c
call fcn.3001b86c
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x300235d7
mov eax, dword [0x300408e4]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
jmp 0x300235fc
push 0x30023258
call dword [0x300408ec]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x30025a1c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.30015938
xor eax, eax
push ebp
push 0x30025adc
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
setne bl
xor eax, eax
mov dword [ebp - 8], eax
test bl, bl
jne 0x30025ac6
cmp dword [ebp - 4], 0
jne 0x30025a69
lea edx, [ebp - 8]
mov eax, esi
call fcn.3001e654
test al, al
je 0x30025ac6
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [ebp - 0xc]
call fcn.3001e654
test al, al
je 0x30025ab7
cmp dword [ebp - 4], 0
je 0x30025a97
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x30025aae
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
call sub.ADVAPI32.dll_EqualSid
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_LocalFree
cmp dword [ebp - 8], 0
je 0x30025ac6
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30025ae3
lea eax, [ebp - 4]
call fcn.300154e8
ret

Function at 0x30025bc4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x30025c6d
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
push ebx
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov edi, eax
test edi, edi
je 0x30025c67
push 0
lea eax, [esp + 4]
push eax
push ebx
push edi
push esi
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x30025c61
cmp ebx, dword [esp]
jne 0x30025c61
xor ebx, ebx
mov eax, dword [esp]
dec eax
shr eax, 1
test eax, eax
jl 0x30025c4b
inc eax
xor edx, edx
movzx ecx, word [edi + edx*2]
add ebx, ecx
test ebx, 0xffff0000
je 0x30025c47
mov ecx, ebx
and ecx, 0xffff
shr ebx, 0x10
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x30025c2a
mov eax, ebx
and ax, 0xffff
shr ebx, 0x10
add ax, bx
movzx eax, ax
mov ebx, eax
mov ebp, dword [esp]
add ebp, ebx
push edi
call sub.KERNEL32.dll_LocalFree
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x30025c78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x30025d87
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x300406b8], 0
jne 0x30025d59
cmp byte [0x3003fcb8], 0
je 0x30025cc1
push ebx
push 0x104
call sub.KERNEL32.dll_GetTempPathW
jmp 0x30025ccc
push 0x104
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryW
test eax, eax
jne 0x30025cdb
mov word [ebx], 0x2e
mov word [ebx + 2], 0
push ebx
call sub.KERNEL32.dll_lstrlenW
cmp word [ebx + eax*2 - 2], 0x5c
je 0x30025cf4
push 0x30025d94
push ebx
call sub.KERNEL32.dll_lstrcatW
lea edx, [ebp - 0x44]
mov eax, 0x30025da0
call fcn.30017d04
push dword [ebp - 0x44]
push 0x30025db0
lea edx, [ebp - 0x48]
mov eax, 0x30025dbc
call fcn.30017d04
push dword [ebp - 0x48]
push 0x30025dd0
lea edx, [ebp - 0x4c]
mov eax, 0x30025ddc
call fcn.30017d04
push dword [ebp - 0x4c]
lea eax, [ebp - 4]
mov edx, 5
call fcn.30015808
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 4]
call fcn.30015948
push eax
call fcn.3001dfb8
lea eax, [ebp - 0x40]
push eax
push ebx
call sub.KERNEL32.dll_lstrcatW
jmp 0x30025d64
push 0x300406b8
push ebx
call sub.KERNEL32.dll_lstrcpyW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30025d8e
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.3001550c
lea eax, [ebp - 4]
call fcn.300154e8
ret

Function at 0x30025de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.30015938
xor eax, eax
push ebp
push 0x30025e66
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
mov al, byte [ebx]
mov byte [ebp - 5], al
inc ebx
mov edx, dword [ebx]
mov eax, edi
call fcn.30015a30
add ebx, 4
mov esi, dword [edi]
mov al, byte [ebx]
cmp al, byte [ebp - 5]
jne 0x30025e3d
inc ebx
mov eax, ebx
inc eax
movzx eax, byte [eax]
test eax, eax
jle 0x30025e38
mov dl, byte [ebx]
xor dl, 0x55
mov byte [esi], dl
inc esi
dec eax
jne 0x30025e2d
add ebx, 2
jmp 0x30025e43
xor al, 0x55
mov byte [esi], al
inc esi
inc ebx
mov eax, dword [edi]
call fcn.30015748
add eax, dword [edi]
cmp eax, esi
ja 0x30025e1b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30025e6d
lea eax, [ebp - 4]
call fcn.300154e8
ret
Function at 0x30027118
Capabilities:
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], eax
xor eax, eax
push ebp
push 0x3002733f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
lea edx, [ebp - 0x220]
mov eax, 0x30027358
call fcn.30017d04
push dword [ebp - 0x220]
push 0x30027384
lea edx, [ebp - 0x224]
mov eax, 0x30027390
call fcn.30017d04
push dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.30015808
mov eax, dword [ebp - 0x21c]
call fcn.30015948
push eax
push SysFreeString
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x30027255
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea edx, [ebp - 0x228]
mov eax, 0x300273a4
call fcn.30017d04
mov eax, dword [ebp - 0x228]
call fcn.30015948
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x3002720b
cmp dword [ebp - 8], 4
je 0x30027212
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x3002721b
cmp dword [ebp - 4], 0
jbe 0x3002721b
dec dword [ebp - 4]
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
mov eax, 0x300273a4
lea edx, [ebp - 0x22c]
call fcn.30017d04
mov eax, dword [ebp - 0x22c]
call fcn.30015948
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x3002725a
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x3002731f
call fcn.300268e4
test al, al
je 0x30027321
push 0xf003f
push 0
push 0
call dword [0x30040918]
mov esi, eax
test esi, esi
je 0x30027321
push 0x101ff
lea edx, [ebp - 0x234]
mov eax, 0x30027390
call fcn.30017d04
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x230]
mov dl, 1
call fcn.30017d74
mov eax, dword [ebp - 0x230]
push eax
push esi
call dword [0x3004091c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x30027309
mov eax, dword [ebp - 4]
push eax
call dword [0x30040914]
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x300272fd
mov word [ebp - 0x216], 0
lea eax, [ebp - 0x216]
call fcn.30025c78
lea eax, [ebp - 0x216]
push eax
call sub.KERNEL32.dll_DeleteFileW
mov eax, dword [ebp - 4]
push eax
call dword [0x3004090c]
jmp 0x30027316
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x424
sete bl
push esi
call dword [0x3004090c]
jmp 0x30027321
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30027346
lea eax, [ebp - 0x234]
mov edx, 7
call fcn.3001550c
ret
Function at 0x300273b4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.30015938
xor eax, eax
push ebp
push 0x30027481
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.30015948
push eax
push esi
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x30027451
xor ebx, ebx
jmp 0x3002742e
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.30015730
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 8]
call fcn.300273b4
pop ecx
inc ebx
push 0x104
lea eax, [ebp - 0x10d]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegEnumKeyA
test eax, eax
je 0x30027404
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 4]
call fcn.30015948
push eax
push esi
call sub.ADVAPI32.dll_RegDeleteKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30027488
lea eax, [ebp - 0x114]
call fcn.300154e8
lea eax, [ebp - 4]
call fcn.300154e8
ret