joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6049d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0063d428
add esp, 0x18
test eax, eax
je 0x6049f2
cmp eax, 0xffffffff
jne 0x6049f4
xor eax, eax
pop ebp
ret

Function at 0x6128d0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x612902
push str.Couldnt_set_desired_mode
push esi
call fcn.005f06f0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x612919
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.005f07b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x612932
push ebx
push esi
call fcn.00612580
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x612947
push esi
call fcn.00611570
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x61295c
push esi
call fcn.00612560
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x61296c
push esi
call fcn.006127b0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6275e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x70d4c4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x62760d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x627657
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x62765d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x6276bb
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x627680
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x6276e7
mov eax, dword [esi + 4]
push 1
push 0x6759f4
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6759f5
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x6276c0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64875b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006485d1
Function at 0x407769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b190
cmp edx, dword [eax]
je 0x40778b
add eax, 8
inc ecx
cmp eax, 0x40b220
jl 0x40777c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b190]
jne 0x4078b9
mov eax, dword [0x40bbb0]
cmp eax, 1
je 0x407893
test eax, eax
jne 0x4077bc
cmp dword [0x40b0e4], 1
je 0x407893
cmp edx, 0xfc
je 0x4078b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4077f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x407836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a45c
push edi
call fcn.00408f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408680
lea eax, [ebp - 0xa0]
push 0x40a43c
push eax
call fcn.00408680
push dword [esi + 0x40b194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408e75
add esp, 0x2c
pop edi
jmp 0x4078b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40b194]
push 0
push eax
push dword [esi]
call fcn.00408490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0xfeaf18
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfeaf22
pushal
call 0xfeaf28
pop ebp
sub ebp, 0x10
sub ebp, 0xbeaf18
jmp 0xfeaf3e
mov eax, 0xbeaf18
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cf
mov edx, 0xcc67d018
xor byte [eax], dl
inc eax
dec ecx
jne 0xfeaf55
jmp 0xfeaf68
xchg ebx, eax
aad 0x93
xchg ecx, eax
and al, 0x18
sbb byte [eax], bl
cdq
fchs
sbb byte [eax], bl
sbb byte [ebx], bl
aad 0xa0
sbb al, 0x18
sbb byte [eax], bl
sbb byte [eax], bl
sbb edx, ebp
mov al, byte [0x1818181c]
mov byte [0x18181830], al
out dx, eax
cli
sbb edx, eax
xchg ebx, eax
cdq
adc al, 0x18
sbb byte [eax], bl
sbb ebx, ebp
xchg ebp, eax
jl 0xfeafcd
in al, 0x91
sbb al, 0x3c
dec eax
jo 0xfeaf78
mov dword [0x6701839], eax
jmp 0xfeaf23
fyl2x
sbb ch, byte [ecx]
sbb bl, byte [ebx + 0x17511cda]
popfd
in al, dx
out 0xe7, eax
out 0x45, eax
ficom dword [eax + ebx]
xchg ebx, eax
xchg esp, eax
cmp al, 0x1c
sbb byte [eax], bl
sbb byte [eax - 0x20], dh
mov dword [0x6701839], eax
jmp 0xfeaf74
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10004386
pop dword [ebp - 0x44]
mov eax, 0x10004386
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x8d993c4c
sub dword [ebp - 0x54], 0x3f46f701
mov dword [ebp - 0x50], 0x521d8d56
sub dword [ebp - 0x50], 0x1fea4111
mov dword [ebp - 0x4c], 0xf8b6a9d6
sub dword [ebp - 0x4c], 0xac6a65a8
mov dword [ebp - 0x48], 0x2f75943a
add dword [ebp - 0x48], 0xd08a6bc6
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x811c93a7
sub dword [ebp - 0x54], 0xcaa2a51
mov dword [ebp - 0x50], 0xb4715a7e
add dword [ebp - 0x50], 0x8cfb06f7
mov dword [ebp - 0x4c], 0xd91e963
add dword [ebp - 0x4c], 0x55dd8309
mov dword [ebp - 0x48], 0x65999406
add dword [ebp - 0x48], 0x9a666bfa
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x357f8
push 0
call eax
mov ecx, 0x39932a87
add ecx, 0xc66d1945
xor ebx, ebx
add ebx, eax
mov edx, 0x1000a800
add edx, dword [ebp - 0x44]
mov edi, 0x4118476f
add edi, 0x82894e9c
sub dword [ebp - 0x34], 0x6ca531d0
mov esi, dword [edx]
sub dword [ebp - 8], ecx
xor esi, edi
add dword [ebp - 0x38], 0x45d37766
mov dword [ebx], esi
sub dword [ebp - 4], 0x88fadfa2
add ebx, 4
add edx, 0x259f7330
add edx, 0xda608cd4
loop 0x10004495
add eax, 0xc8803086
add eax, 0x3780d17d
xor ebx, ebx
add ebx, eax
add eax, 0xd90ab89b
add eax, 0x26f5476a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x3001110
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
test esi, esi
jne 0x3001139
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
je 0x300113b
mov eax, esi
pop esi
ret

Function at 0x30014f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push str.PPWebCap
mov ecx, edi
xor esi, esi
call fcn.030015b0
push str.Uploader
mov ecx, edi
call fcn.030015b0
push str.PersistentDataEasyLinks
mov ecx, edi
call fcn.030015b0
push esi
push esi
mov ecx, dword [edi]
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push esi
push eax
push esi
push esi
push esi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x3001543
mov dword [esp + 0x18], 0xff
mov edx, dword [esp + 0x18]
inc edx
push edx
call fcn.0300758f
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x18]
mov edx, dword [edi]
push 0
inc eax
push 0
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
push 0
mov eax, esi
push ecx
push ebx
push eax
push edx
inc esi
call ebp
test eax, eax
je 0x3001584
cmp eax, 0xea
jne 0x300159c
push ebx
call fcn.03001440
add esp, 4
test al, al
je 0x3001559
push ebx
mov ecx, edi
call fcn.030015b0
dec esi
jmp 0x3001559
push ebx
call fcn.03007526
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x30015b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x300f8ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x134]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x3001628
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
je 0x3001618
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x300163a
jmp 0x300162c
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x30016d5
push ecx
jmp 0x30016cf
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x30016a0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.030015b0
mov ebx, eax
cmp ebx, edi
jne 0x30016f1
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x3001662
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x30016b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x134]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x30016d5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x3001700
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x30016d7
Function at 0x30020a0
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi]
inc eax
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8
Function at 0x30037e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x3015424]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov eax, dword [0x3015430]
mov bl, byte [0x3015434]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x3015434], 1
test eax, eax
jne 0x3003829
push str.PPSchUI.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Init
push eax
mov dword [0x301542c], eax
call esi
call eax
mov edx, dword [0x3015430]
mov ecx, dword [0x301542c]
inc edx
push str.ShowUI
push ecx
mov dword [0x3015430], edx
call esi
push 0x30152b0
call eax
mov eax, dword [0x3015430]
add esp, 4
dec eax
mov dword [0x3015430], eax
jne 0x3003877
mov edx, dword [0x301542c]
push str.DeInit
push edx
call esi
call eax
mov eax, dword [0x301542c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [0x3015435]
mov byte [0x3015434], bl
test al, al
jne 0x3003895
test bl, bl
jne 0x3003895
mov ecx, dword [0x3015424]
push 0
push ecx
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x30038a0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x3015424]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov bl, byte [0x3015435]
mov ecx, 0x30152b0
mov byte [0x3015435], 1
call fcn.03005e60
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov eax, dword [0x3015430]
setne cl
test eax, eax
mov byte [esp + 0xc], cl
jne 0x30038fd
push str.PPSchUI.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Init
push eax
mov dword [0x301542c], eax
call esi
call eax
mov edx, dword [0x3015430]
push str.ShowSettings
inc edx
mov dword [0x3015430], edx
mov edx, dword [0x301542c]
push edx
call esi
mov ecx, dword [esp + 0xc]
push ecx
call eax
mov eax, dword [0x3015430]
add esp, 4
dec eax
mov dword [0x3015430], eax
jne 0x300394b
mov edx, dword [0x301542c]
push str.DeInit
push edx
call esi
call eax
mov eax, dword [0x301542c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [0x3015434]
mov byte [0x3015435], bl
test al, al
jne 0x3003969
test bl, bl
jne 0x3003969
mov ecx, dword [0x3015424]
push 0
push ecx
call edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x3003970
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x3015424]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov eax, dword [0x3015430]
mov bl, byte [0x3015434]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x3015434], 1
test eax, eax
jne 0x30039b9
push str.PPSchUI.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Init
push eax
mov dword [0x301542c], eax
call esi
call eax
mov ecx, dword [0x3015430]
push str.ShowStartupWarn
inc ecx
mov dword [0x3015430], ecx
mov ecx, dword [0x301542c]
push ecx
call esi
call eax
mov eax, dword [0x3015430]
dec eax
mov dword [0x3015430], eax
jne 0x30039ff
mov edx, dword [0x301542c]
push str.DeInit
push edx
call esi
call eax
mov eax, dword [0x301542c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [0x3015435]
mov byte [0x3015434], bl
test al, al
jne 0x3003a1d
test bl, bl
jne 0x3003a1d
mov ecx, dword [0x3015424]
push 0
push ecx
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x3003b00
Capabilities:
Inspect load icon resource

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0
push esi
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x30153bc
push 0x3015358
push 0
mov dword [0x3015420], esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, eax
mov ecx, 0x16
xor eax, eax
mov edi, 0x3015300
rep stosd dword es:[edi], eax
mov eax, dword [0x3015420]
push 0x6b
push eax
mov dword [0x3015424], edx
mov dword [0x3015300], 0x58
mov dword [0x3015304], edx
mov dword [0x3015308], 0x82
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x40
push 0x3015318
push 0x87
push esi
mov dword [0x3015314], eax
mov dword [0x301530c], 7
mov dword [0x3015310], 0x800a
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x3015300
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov ecx, dword [0x3015424]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret
Function at 0x3003c20
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x31c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
xor bl, bl
mov dword [esp + 0x24], 0xff
mov dword [esp + 0x20], 1
call esi
test eax, eax
je 0x3003c9e
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push 0x30152a8
push 0x80000001
call esi
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0x2001f
push 0
push 0x30152a8
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x124]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.PPScheduler
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x3003d26
lea eax, [esp + 0x1c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x3003cfb
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.03007d3c
add esp, 8
test eax, eax
je 0x3003cfb
push str.PPScheduler.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x20]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push str.PPScheduler
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
jmp 0x3003d28
mov bl, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop esi
pop ebx
add esp, 0x31c
ret
Function at 0x3004060
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x3015438]
sub esp, 0x104
test eax, eax
jne 0x3004117
mov al, byte [0x30152a8]
push ebx
push esi
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x3012120
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.shfolder.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
test eax, eax
mov dword [0x3015438], eax
pop ebx
jne 0x3004117
add esp, 0x104
ret
mov ecx, dword [0x301543c]
test ecx, ecx
jne 0x3004140
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
mov dword [0x301543c], ecx
jne 0x3004140
add esp, 0x104
ret
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
push edx
mov edx, dword [esp + 0x114]
push eax
mov eax, dword [esp + 0x114]
push edx
mov edx, dword [esp + 0x114]
push eax
push edx
call ecx
add esp, 0x104
ret

Function at 0x3006270
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
mov esi, ecx
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x2c], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x30], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x3c], eax
call edi
push 0
push 1
push 1
push 0
mov dword [esi + 0x40], eax
call edi
push 0
push 1
push 1
push 0
mov dword [esi + 0x44], eax
call edi
mov dword [esi + 0x48], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x30063d0
push 0
push 0
call edi
lea ecx, [esp + 8]
mov dword [esi + 0x34], eax
push ecx
push 0
push esi
push 0x30067b0
push 0
push 0
call edi
mov dword [esi + 0x38], eax
pop edi
pop esi
pop ecx
ret
Function at 0x3006360
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
mov dword [esp], 0
push eax
push 0x20019
push 0
push str.SoftwareScansoftPaperPortPPScheduler
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30063ba
lea ecx, [esp + 8]
lea edx, [esp]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.StopWorking
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0xc
ret
Function at 0x6d5ac5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101612bf
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0
mov dword [ebx], reloc.MSVCRT.dll_strncpy
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x68], 0x1017f6a4
mov dword [ebp - 4], 0
lea esi, [ebx + 4]
mov eax, dword [ebx]
push 0
push esi
mov dword [ebp - 0x18], 1
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], esi
mov dword [ebx + eax], reloc.MSVCRT.dll_strncpy
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.006d6575
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], reloc.MSVCRT.dll_strncpy
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.006d6755
lea eax, [ebx + 4]
lea ebx, [eax + 4]
mov dword [eax], reloc.MSVCRT.dll_strncpy
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov byte [eax + 0x48], 0
lea esi, [eax + 8]
mov byte [eax + 0x3d], 0
lea edi, [eax + 0x14]
mov dword [eax + 0x10], esi
lea edx, [eax + 0x24]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x1c]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp - 0x14]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov ecx, dword [reloc.MSVCRT.dll_strncpy]
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 3
cmp dword [ebx + 0x4c], 0
jne 0x6d5c90
push 0x40
push 0x32
push dword [ebp + 8]
call fcn.0070c550
add esp, 0xc
test eax, eax
je 0x6d5c90
push 1
push eax
mov ecx, ebx
call fcn.006d5835
mov eax, dword [ebx + 0x34]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
call fcn.006d70c5
add esp, 4
mov ecx, ebx
push eax
call fcn.006d56d5
test esi, esi
je 0x6d5c79
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x6d5c79
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.006cb805
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10