joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3005d6ee
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x820
mov eax, 0x30184486
call fcn.3010f702
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push edi
mov dword [ebp - 0x820], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x828], ebx
cmp ebx, 0xffffffff
mov dword [ebp - 4], esi
jne 0x3005d73f
push esi
push edi
push 0x34
push esi
call fcn.300e6de2
push ebx
jmp 0x3005d95f
lea eax, [ebp - 0x82c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x82c], esi
jne 0x3005d950
cmp eax, 0x186a0
ja 0x3005d950
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea eax, [ebp - 0x814]
push eax
push 2
lea eax, [ebp - 0x824]
push eax
push ebx
mov dword [ebp - 0x814], esi
call edi
test eax, eax
je 0x3005d95a
mov eax, dword [0x30025c28]
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 2
mov byte [ebp - 4], 1
jne 0x3005d7b3
cmp word [ebp - 0x824], 0xfeff
je 0x3005d84c
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, 0x400
jmp 0x3005d8ea
cmp dword [ebp - 0x814], esi
je 0x3005d910
test dword [ebp - 0x814], 0xfffffffe
mov dword [ebp - 0x81c], esi
jbe 0x3005d84c
mov eax, dword [ebp - 0x81c]
movzx ecx, word [ebp + eax*2 - 0x810]
movzx eax, cx
cmp eax, 0xa
je 0x3005d80e
cmp eax, 0xd
je 0x3005d80e
push ecx
lea ecx, [ebp - 0x818]
call fcn.30149603
jmp 0x3005d836
mov eax, dword [ebp - 0x818]
cmp word [eax], si
je 0x3005d836
mov ecx, dword [ebp - 0x820]
lea eax, [ebp - 0x818]
push eax
call fcn.3005d5f4
lea ecx, [ebp - 0x818]
call fcn.3004fc42
mov eax, dword [ebp - 0x814]
inc dword [ebp - 0x81c]
shr eax, 1
cmp dword [ebp - 0x81c], eax
jb 0x3005d7e5
push esi
lea eax, [ebp - 0x814]
push eax
push 0x800
lea eax, [ebp - 0x810]
push eax
push ebx
call edi
test eax, eax
jne 0x3005d7c7
jmp 0x3005d910
cmp dword [ebp - 0x814], esi
je 0x3005d90a
xor eax, eax
cmp dword [ebp - 0x814], esi
mov dword [ebp - 0x81c], eax
jbe 0x3005d8ea
mov al, byte [ebp + eax - 0x410]
cmp al, 0xa
je 0x3005d8ad
cmp al, 0xd
je 0x3005d8ad
movzx ax, al
lea ecx, [ebp - 0x818]
push eax
call fcn.30149603
jmp 0x3005d8d5
mov eax, dword [ebp - 0x818]
cmp word [eax], si
je 0x3005d8d5
mov ecx, dword [ebp - 0x820]
lea eax, [ebp - 0x818]
push eax
call fcn.3005d5f4
lea ecx, [ebp - 0x818]
call fcn.3004fc42
mov eax, dword [ebp - 0x81c]
inc eax
cmp eax, dword [ebp - 0x814]
mov dword [ebp - 0x81c], eax
jb 0x3005d88c
push esi
lea eax, [ebp - 0x814]
push eax
push ebx
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x828]
call edi
test eax, eax
jne 0x3005d870
mov ebx, dword [ebp - 0x828]
mov eax, dword [ebp - 0x818]
cmp word [eax], si
je 0x3005d941
mov ecx, dword [ebp - 0x820]
lea eax, [ebp - 0x818]
push eax
call fcn.3005d5f4
mov eax, dword [ebp - 0x818]
cmp word [eax], si
je 0x3005d941
add eax, 0xfffffff8
push eax
call fcn.301471a2
cmp ebx, esi
je 0x3005d94c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x3005d967
push esi
push edi
push 0x39
push esi
call fcn.300e6de2
cmp ebx, esi
je 0x3005d965
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.3010f785
ret 4
Function at 0x3005e55b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x301b6ecc], 0
push esi
je 0x3005e66c
push ebx
push edi
call dword [sym.imp.USER32.dll_GetCapture]
mov ebx, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor edi, edi
cmp ebx, edi
jne 0x3005e597
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov ebx, eax
cmp ebx, edi
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
je 0x3005e664
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x3005e664
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jge 0x3005e5d0
push 4
pop edi
push 0x11
call esi
test ax, ax
jge 0x3005e5dc
or edi, 8
push 1
call esi
test ax, ax
jge 0x3005e5e8
or edi, 1
push 2
call esi
test ax, ax
jge 0x3005e5f4
or edi, 2
push 4
call esi
test ax, ax
jge 0x3005e600
or edi, 0x10
movzx eax, word [ebp - 0xc]
movzx ecx, word [ebp - 0x10]
shl eax, 0x10
or eax, ecx
push eax
push edi
push 0x200
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
call fcn.30060b28
test eax, eax
je 0x3005e635
push 0x30002508
mov ecx, eax
call fcn.30064243
test eax, eax
jne 0x3005e66a
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
shl eax, 0x10
or eax, ecx
push eax
push 0
push 0x84
push ebx
call esi
movzx eax, ax
or eax, 0x2000000
push eax
push ebx
push 0x20
push ebx
call esi
jmp 0x3005e66a
push edi
call fcn.3005e520
pop edi
pop ebx
mov byte [0x301b6ecc], 0
pop esi
leave
ret

Function at 0x3005e9d7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
and word [esi + 2], 0
mov word [esi], ax
call dword [sym.imp.USER32.dll_GetMessageTime]
cmp dword [ebp + 0x10], 0
mov dword [esi + 4], eax
setl al
cmp dword [ebp + 8], 0x102
mov byte [esi + 8], al
jne 0x3005ea10
cmp word [esi], 0x20
sbb al, al
inc al
jmp 0x3005ea67
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jge 0x3005ea25
or word [esi + 2], 8
push 0x10
call edi
test ax, ax
jge 0x3005ea33
or word [esi + 2], 4
push 0x12
call edi
test ax, ax
pop edi
jge 0x3005ea42
or word [esi + 2], 0x20
movzx eax, word [esi]
cmp eax, 8
jl 0x3005ea65
cmp eax, 9
jle 0x3005ea61
cmp eax, 0xd
je 0x3005ea61
cmp eax, 0x1b
je 0x3005ea61
add eax, 0xffffffdf
cmp eax, 7
ja 0x3005ea65
mov al, 1
jmp 0x3005ea67
xor al, al
pop esi
pop ebp
ret 0x10
Function at 0x3005ea6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x10
je 0x3005ea81
cmp dword [ebp + 0xc], 0x11
je 0x3005ea81
cmp dword [ebp + 0xc], 0x12
jne 0x3005ea9c
cmp dword [ebp + 8], 0x100
je 0x3005ea93
cmp dword [ebp + 8], 0x104
jne 0x3005eaa3
test dword [ebp + 0x10], 0x40000000
je 0x3005eaa3
xor al, al
jmp 0x3005eb36
push esi
mov esi, dword [ebp + 0x18]
push edi
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
push esi
push esi
call dword [eax + 0x10]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
and word [esi + 0xc], 0
push 0x10
call edi
shr eax, 8
test al, al
je 0x3005ead4
or word [esi + 0xc], 4
push 0x11
call edi
shr eax, 8
test al, al
je 0x3005eae4
or word [esi + 0xc], 8
push 0x12
call edi
shr eax, 8
test al, al
je 0x3005eaf4
or word [esi + 0xc], 0x20
call dword [sym.imp.USER32.dll_GetMessageTime]
and dword [esi + 8], 0
push 1
mov dword [esi + 0x10], eax
call edi
shr eax, 8
test al, al
je 0x3005eb10
or dword [esi + 8], 1
push 2
call edi
shr eax, 8
test al, al
je 0x3005eb1f
or dword [esi + 8], 4
push 4
call edi
shr eax, 8
test al, al
je 0x3005eb2e
or dword [esi + 8], 2
and dword [esi + 0x14], 0
pop edi
mov al, 1
pop esi
pop ebp
ret 0x14

Function at 0x3005f442
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
push edi
xor edi, edi
inc edi
test al, 4
mov dword [ebp - 4], 0x202
je 0x3005f46a
mov dword [ebp - 4], 0x205
push 2
jmp 0x3005f477
test al, 2
je 0x3005f478
mov dword [ebp - 4], 0x208
push 4
pop edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
push 0
push dword [ebp - 4]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x3005f4da
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x3005f4b3
cmp edi, 1
jne 0x3005f4ab
push 2
pop edi
jmp 0x3005f4b3
cmp edi, 2
jne 0x3005f4b3
xor edi, edi
inc edi
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x3005f4da
movzx eax, word [esi + 4]
movzx ecx, word [esi]
shl eax, 0x10
or eax, ecx
push eax
push 0
push dword [ebp - 4]
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x3005fccf
Capabilities:
Check os version

Disassembly:
push 0xc
mov eax, 0x30184664
call fcn.3010f6cc
mov eax, dword [0x301b6ee0]
xor ebx, ebx
cmp eax, ebx
jne 0x3005fde1
lea eax, [ebp - 0x14]
push eax
push 0x30002634
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call fcn.300f4f22
cmp eax, ebx
je 0x3005fd07
cmp dword [ebp - 0x14], ebx
jne 0x3005fd5b
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x3005fd3f
cmp al, 5
jb 0x3005fd3f
push 0x30002940
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
je 0x3005fd3f
push 0x30002924
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x3005fd3f
call eax
movzx eax, ax
movzx eax, ax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jne 0x3005fd5b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x3005fd5b
mov dword [ebp - 0x14], 0x409
test byte [0x301b6f8c], 1
jne 0x3005fd9e
mov eax, dword [ebp - 0x14]
or dword [0x301b6f8c], 1
push 0x30194d96
mov dword [0x301b6f7c], ebx
mov byte [0x301b6f80], bl
mov dword [0x301b6f78], 0x30002850
mov dword [0x301b6f84], 0xabcd0001
mov dword [0x301b6f88], eax
call fcn.3010f999
pop ecx
mov ecx, 0x301b6f78
call fcn.30063f53
or dword [ebp - 4], 0xffffffff
mov esi, eax
jmp 0x3005fdba
cmp esi, ebx
jne 0x3005fdc2
xor eax, eax
jmp 0x3005fde1
push esi
call fcn.3005f0b0
push esi
lea ebx, [ebp - 0x14]
mov dword [0x301b6ffc], esi
call fcn.3005fb89
push dword [ebp - 0x14]
call fcn.3005ef48
mov eax, esi
call fcn.3010f771
ret

Function at 0x30060b58
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x301847a9
call fcn.3010f699
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.30148a97
xor edi, edi
inc edi
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x10]
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push 0x4000000
push edi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x38], edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
test bl, bl
je 0x30060c01
cmp byte [ebp + 0x14], 0
je 0x30060bf1
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0xfa
push ebx
push dword [ebp - 0x20]
call esi
mov edi, 0x102
jmp 0x30060be6
call fcn.30060a83
push ebx
push dword [ebp - 0x20]
call esi
cmp eax, edi
je 0x30060bdb
test eax, eax
sete bl
xor esi, esi
push dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp + 0xc]
cmp word [eax], si
je 0x30060c1b
add eax, 0xfffffff8
push eax
call fcn.301471a2
mov al, bl
call fcn.3010f771
ret 0x10
Function at 0x300623c7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x300623e1
test al, 0x10
jne 0x300623e1
xor eax, eax
inc eax
jmp 0x300623e3
xor eax, eax
pop ebp
ret 4

Function at 0x30062525
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebx]
and dword [ebx], 0
test edi, edi
jle 0x30062594
mov esi, 0xfffe
cmp edi, esi
jbe 0x3006254a
sub edi, esi
mov dword [ebp + 0xc], edi
mov edi, esi
jmp 0x3006254e
and dword [ebp + 0xc], 0
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x30062570
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
je 0x30062587
mov eax, dword [ebp - 4]
add dword [ebx], eax
cmp eax, edi
jne 0x30062590
cmp dword [ebp + 0xc], 0
jle 0x30062594
add dword [ebp + 0x10], esi
mov edi, dword [ebp + 0xc]
jmp 0x3006253d
push 0
push 0xffffffffffffffff
call fcn.300622b3
mov al, 1
jmp 0x30062596
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x3006266f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x300626d1
push esi
mov esi, 0xfffe
push edi
cmp ebx, esi
jbe 0x3006268b
sub ebx, esi
mov edi, esi
jmp 0x30062690
movzx edi, bx
xor ebx, ebx
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x300626b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
je 0x300626c0
cmp dword [ebp + 0xc], edi
jb 0x300626c9
test ebx, ebx
jle 0x300626cf
add dword [ebp + 0x10], esi
jmp 0x30062681
push 0
push 0xffffffffffffffff
call fcn.300622b3
push 0
push 0x70
jmp 0x300626c4
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x30062980
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1104
call fcn.3010f79d
mov eax, dword [0x30024a78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1104], ecx
xor esi, esi
push 4
mov dword [ebp - 0x1100], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
push esi
mov dword [ebp - 0x50], ecx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x4c], 0x20
mov dword [ebp - 0x48], esi
mov word [ebp - 0x44], si
call fcn.3006288f
lea eax, [ebp - 0x10e8]
mov dword [ebp - 0x10f4], eax
mov dword [ebp - 0x10f0], 0x825
mov dword [ebp - 0x10ec], esi
mov word [ebp - 0x10e8], si
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 0xfff
mov edi, eax
and edi, ebx
lea esi, [edi + 1]
and esi, ebx
cmp esi, edi
mov dword [ebp - 0x10f8], 4
je 0x30062ad6
push dword [ebp - 0x1100]
lea ecx, [ebp - 0x10f4]
call fcn.30062931
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x10f4]
call fcn.30062954
xor eax, eax
push eax
push eax
push eax
push eax
push esi
lea ecx, [ebp - 0x50]
call fcn.3014971d
push dword [ebp - 0x1104]
lea ecx, [ebp - 0x50]
call fcn.300628de
push dword [ebp - 0x50]
lea ecx, [ebp - 0x10f4]
call fcn.30062954
push 0
push 0x2000080
push 3
push 0
push 3
push SysReAllocString
push dword [ebp - 0x10f4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x30062ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov dword [ebp - 0x10f8], eax
je 0x30062ac3
cmp eax, 3
je 0x30062aca
cmp eax, 0xf
je 0x30062aca
cmp eax, 0x53
je 0x30062aca
inc esi
and esi, ebx
cmp esi, edi
jne 0x30062a26
jmp 0x30062aca
and dword [ebp - 0x10f8], 0
cmp dword [ebp - 0x10f8], 0
pop edi
pop esi
pop ebx
je 0x30062ae7
push dword [ebp - 0x10f4]
push dword [ebp - 0x10f8]
call fcn.300622b3
push dword [ebp - 0x10f4]
mov ecx, dword [ebp - 0x10fc]
call fcn.30148fce
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3010f365
leave
ret 0x10
Function at 0x300653f9
Capabilities:
Create thread
Resume thread

Disassembly:
push 4
mov eax, 0x30184b36
call fcn.3010f699
mov esi, ecx
xor edi, edi
mov eax, 0x301b7044
lea ebx, [esi + 4]
push eax
mov dword [esi], edi
mov dword [ebx], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push 4
push esi
push 0x30065259
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
mov dword [esi], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x10], eax
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x14], eax
call ebx
mov ecx, dword [esi]
cmp ecx, edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], eax
je 0x300654c2
cmp dword [esi + 0x10], edi
je 0x300654bf
cmp dword [esi + 0x14], edi
je 0x300654bf
cmp eax, edi
je 0x300654bf
mov eax, dword [0x301b709c]
mov dword [esi + 0x1c], eax
xor ecx, ecx
mov dword [0x301b709c], esi
mov eax, 0x301b7040
inc ecx
lock xadd dword [eax], ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [0x301b7034]
push 0x301b7044
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.3010f771
ret
push ecx
call ebx
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x300654cc
push eax
call ebx
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x300654d6
push eax
call ebx
mov esi, dword [esi + 0x18]
cmp esi, edi
je fcn.3014a3c3
push esi
call ebx
jmp fcn.3014a3c3
Function at 0x30067758
Capabilities:
Encode data using xor

Disassembly:
push 0x74
mov eax, 0x30184eee
call fcn.3010f702
and dword [ebp - 0x60], 0
push 0
push 0
push 1
push ecx
lea ecx, [ebp - 0x5c]
call fcn.3010a459
and dword [ebp - 4], 0
jmp 0x3006784e
mov ebx, dword [esi + 0x14c]
mov ecx, esi
call fcn.3006638e
test ebx, ebx
je 0x300677a1
mov ecx, dword [ebx]
shr ecx, 8
test cl, 3
jne 0x300677a9
cmp byte [ebx + 0x10], 0
jne 0x300677a9
test al, al
je 0x3006784e
cmp byte [0x301f7138], 0
jne 0x3006780a
xor edi, edi
inc edi
mov ecx, 0x301b7138
mov dword [ebp - 0x64], 0x100
xor eax, eax
imul edi, edi, 0x343fd
add edi, 0x269ec3
sar edi, 0x10
and edi, 0x7fff
mov edx, edi
and edx, 0x800000ff
jns 0x300677ea
dec edx
or edx, 0xffffff00
inc edx
mov byte [ecx + eax], dl
inc eax
cmp eax, 4
jl 0x300677c3
add ecx, 4
dec dword [ebp - 0x64]
jne 0x300677c1
cmp ecx, 0x301f7138
jl 0x300677ba
mov byte [0x301f7138], 1
push 7
xor eax, eax
test ebx, ebx
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
je 0x30067823
lea eax, [ebp - 0x80]
push eax
mov ecx, ebx
call fcn.30083ef5
mov ecx, dword [esi + 0x18]
xor eax, eax
mov edx, ecx
movzx esi, byte [ebp + eax - 0x80]
mov edi, edx
and edi, 0xff
shl edi, 8
add esi, edi
mov esi, dword [esi*4 + 0x301b7138]
xor dword [ebp - 0x60], esi
inc eax
add edx, ecx
cmp eax, 0x1c
jb 0x3006782a
lea ecx, [ebp - 0x5c]
call fcn.3010a372
mov esi, eax
test esi, esi
jne 0x30067780
lea ecx, [ebp - 0x1c]
call fcn.300674b2
lea ecx, [ebp - 0x1c]
call fcn.3014bfae
mov eax, dword [ebp - 0x60]
call fcn.3010f785
ret
Function at 0x3006a9d7
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0x94c
mov eax, 0x30185504
call fcn.3010f702
lea eax, [ebp + 8]
push eax
mov ecx, 0x301ae624
mov dword [ebp - 0x958], 0x30003998
call fcn.3006a784
test al, al
je 0x3006aa0a
xor eax, eax
inc eax
jmp 0x3006ab19
lea eax, [ebp + 8]
push eax
mov ecx, 0x301ae634
call fcn.3006a784
test al, al
jne 0x3006ab16
mov eax, dword [ebp + 8]
push 5
pop ecx
mov esi, 0x30003c28
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
movzx cx, al
mov word [ebp - 0x1a], cx
movzx cx, ah
shr eax, 0x10
mov word [ebp - 0x18], cx
movzx cx, al
movzx ax, ah
xor ebx, ebx
cmp byte [0x301b6fea], bl
mov word [ebp - 0x16], cx
mov word [ebp - 0x14], ax
je 0x3006ab21
mov dword [ebp - 0x954], ebx
lea eax, [ebp - 0x954]
push eax
push 0x20019
push ebx
push 0x30003bb8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x3006aadf
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x954]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x3006aadf
push 0x300e7e89
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x958]
push eax
mov ecx, 0x301ae624
call fcn.3014c0ce
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp - 0x954], ebx
je 0x3006aa02
push dword [ebp - 0x954]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x3006aa02
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x954], ebx
je 0x3006aaf7
push dword [ebp - 0x954]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x300e7e89
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x958]
push eax
mov ecx, 0x301ae634
call fcn.3014c0ce
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 2
pop eax
call fcn.3010f785
ret 4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x950]
call fcn.3004f140
push 0xfe
lea eax, [ebp - 0x123]
push ebx
push eax
mov byte [ebp - 0x124], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x30003ba8
push 0xff
lea eax, [ebp - 0x124]
push eax
push 0x300020eb
lea eax, [ebp - 0x94c]
push eax
push 0x30003b9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x124], bl
je 0x3006aaf7
push 0x300e7e89
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x958]
push eax
mov ecx, 0x301ae624
call fcn.3014c0ce
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x3006aa02
Function at 0x300706c2
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x30185fe9
mov eax, dword fs:[0]
push eax
mov eax, 0x26e8
call fcn.3010f79d
mov eax, dword [0x30024a78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x26e4]
call fcn.30063332
lea eax, [ebp - 0x1668]
mov dword [ebp - 0x1674], eax
xor esi, esi
lea eax, [ebp - 0x1674]
push eax
lea ecx, [ebp - 0x26e4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x1670], 0x825
mov dword [ebp - 0x166c], esi
mov word [ebp - 0x1668], si
call fcn.300630e3
push 0x30003b3c
lea ecx, [ebp - 0x26cc]
call fcn.30062908
push dword [ebp - 0x1674]
lea ecx, [ebp - 0x26cc]
call fcn.30062954
mov dword [ebp - 0x26d0], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x26d0]
push eax
push 0x20019
push esi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov dword [ebp - 0x26d8], eax
mov dword [ebp - 0x26dc], esi
mov edi, 0x100
cmp dword [ebp - 0x26d8], esi
je 0x300707ab
cmp dword [ebp - 0x26d8], 0xea
jne 0x300708b7
lea eax, [ebp - 0x26f4]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x26ec]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x26dc]
mov dword [ebp - 0x26ec], edi
push dword [ebp - 0x26d0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov dword [ebp - 0x26d8], eax
je 0x300708b7
mov dword [ebp - 0x26d4], esi
cmp eax, esi
je 0x300707fd
cmp eax, 0xea
jne 0x3007081f
lea eax, [ebp - 0x26d4]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x26d0]
call ebx
mov dword [ebp - 0x26d8], eax
lea eax, [ebp - 0x26e8]
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push esi
push 0x300045a8
push dword [ebp - 0x26d4]
mov dword [ebp - 0x26e8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30070894
lea eax, [ebp - 0x610]
mov dword [ebp - 0x61c], eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x61c]
mov dword [ebp - 0x618], edi
mov dword [ebp - 0x614], esi
mov word [ebp - 0x610], si
call fcn.3006f3e0
push 1
push esi
push dword [ebp - 0x26cc]
lea ecx, [ebp - 0x61c]
call fcn.301487e7
cmp eax, 0xffffffff
jne 0x300708de
inc dword [ebp - 0x26dc]
cmp dword [ebp - 0x26d4], esi
je 0x30070793
push dword [ebp - 0x26d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30070793
cmp dword [ebp - 0x26d0], esi
je 0x300708cb
push dword [ebp - 0x26d0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26e4]
call fcn.30063394
xor al, al
jmp 0x30070917
cmp dword [ebp - 0x26d4], esi
je 0x300708f2
push dword [ebp - 0x26d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x26d0], esi
je 0x30070906
push dword [ebp - 0x26d0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26e4]
call fcn.30063394
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.3010f365
leave
ret 8