joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30011635
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x30034b3c]
push esi
push edi
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x10]
push eax
push 0x2001b
xor edi, edi
push edi
mov esi, 0x300037d8
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x30011684
push esi
push 0x30003798
call fcn.300106d0
pop ecx
pop ecx
jmp 0x300116f4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x30003760
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x300116f4
push ebx
mov ebx, 0x30003710
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
add ecx, ecx
mov edi, ebx
lea esi, [ebp - 0xc]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x300116c1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x300116f3
mov esi, 0x30003760
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
push ebx
push esi
push 0x300037d8
jne 0x300116e6
push 0x300036c0
jmp 0x300116eb
push 0x30003658
call fcn.300106d0
add esp, 0x10
pop ebx
cmp dword [ebp - 0x10], 0
pop edi
pop esi
je 0x30011705
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x74]
call fcn.3001fd67
add ebp, 0x78
leave
ret

Function at 0x300117a9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x30034b3c]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp + 8], eax
je 0x30011898
cmp dword [ebp + 0xc], eax
je 0x30011898
cmp dword [ebp + 0x10], eax
je 0x30011898
cmp dword [ebp + 0x14], eax
je 0x30011898
cmp dword [ebp + 0x18], eax
je 0x30011898
test byte [0x300774ac], 1
push ebx
push esi
push edi
mov edi, 0x300774a4
jne 0x30011810
or dword [0x300774ac], 1
mov ecx, edi
call fcn.3000d430
push 0x30022496
call fcn.3001fde3
pop ecx
mov esi, dword [ebp + 0x1c]
push 0x30003884
push 0xa
lea eax, [ebp - 0x18]
push eax
lea ebx, [esi + 2]
call fcn.3000d4b9
push ebx
mov ecx, edi
call fcn.3000d531
mov edi, eax
test edi, edi
je 0x30011841
push 0x30003864
call fcn.30010597
pop ecx
jmp 0x30011891
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push ebx
push dword [0x300774a4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esi - 1]
cmp eax, ecx
jbe 0x30011867
push 0x18
pop edi
jmp 0x30011891
lea eax, [ebp - 0x18]
push eax
push dword [0x300774a4]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x30011880
push dword [ebp + 0x14]
jmp 0x30011886
push dword [0x300774a4]
push esi
push dword [ebp + 0x18]
call fcn.3000d5d9
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
jmp 0x3001189b
push 0x57
pop eax
mov ecx, dword [ebp - 4]
call fcn.3001fd67
leave
ret 0x18
Function at 0x30011a8d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x30034b3c]
push ebx
push edi
mov dword [ebp + 0x198], eax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x74], bx
mov ecx, 0x82
lea edi, [ebp - 0x72]
rep stosd dword es:[edi], eax
push 0x30002a20
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x7c], 0x20a
mov dword [ebp - 0x80], 1
call fcn.30019b98
test eax, eax
je 0x30011ae7
push 0x3000391c
call fcn.30010597
pop ecx
jmp 0x30011b34
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x30002b08
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x30011b0e
push 0x300038e8
jmp 0x30011adf
cmp word [ebp - 0x74], 0
je 0x30011b32
lea eax, [ebp - 0x74]
push eax
push 0x105
push 0x300568e8
call fcn.3000d4b9
xor ebx, ebx
mov dword [0x30076d5c], eax
inc ebx
jmp 0x30011b34
xor ebx, ebx
cmp dword [ebp - 0x78], 0
je 0x30011b43
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, ebx
pop ebx
call fcn.3001fd67
add ebp, 0x19c
leave
ret

Function at 0x30011cef
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3f8]
sub esp, 0x478
mov eax, dword [0x30034b3c]
push ebx
push edi
mov dword [ebp + 0x3f4], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor edi, edi
push edi
push 0x300029c0
push SysReAllocString
mov dword [ebp - 0x78], edi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x30011dca
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x3a4]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push dword [ebp + 0x400]
mov dword [ebp - 0x7c], 0x27
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30011dca
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp + 0x3a4]
push eax
push dword [ebp + 0x400]
mov dword [ebp - 0x7c], 0x105
call sub.msi.dll_MsiAdvertiseScriptW
cmp eax, 3
je 0x30011d8b
cmp eax, 4
jne 0x30011dca
push dword [ebp + 0x400]
lea eax, [ebp - 0x74]
push 0x30003a0c
push 0x105
push eax
call fcn.3000def7
add esp, 0x10
push 1
push edi
mov dword [0x30076d5c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x198]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x30011dca
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x78], edi
je 0x30011dd8
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x3f4]
pop edi
mov eax, ebx
pop ebx
call fcn.3001fd67
add ebp, 0x3f8
leave
ret 4
Function at 0x30012155
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x30034b3c]
push ebx
push esi
push dword [ebp + 0x1f0]
mov dword [ebp + 0x1e4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 0x32
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
and dword [ebp - 0x2c], 0
mov ebx, eax
test ebx, ebx
je 0x30012252
push edi
push dword [ebp + 0x1f0]
push 0x30003c3c
push esi
push ebx
call fcn.3000def7
add esp, 0x10
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x300564c8
stosd dword es:[edi], eax
push 0x105
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x80], 0x44
call fcn.3000d4b9
push 0x30003c10
mov dword [0x30076d5c], eax
call fcn.300105be
lea eax, [ebp - 0x28]
push eax
call fcn.300105be
push ebx
call fcn.300105be
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
xor eax, eax
push eax
push eax
push 0x20
push 1
push eax
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x3001223d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x30003bec
mov dword [ebp - 0x2c], eax
call fcn.300105be
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call fcn.3000e2b2
jmp 0x3001224d
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov eax, dword [ebp - 0x2c]
jmp 0x30012257
mov eax, 0xfffffed3
mov ecx, dword [ebp + 0x1e4]
pop esi
pop ebx
call fcn.3001fd67
add ebp, 0x1e8
leave
ret 4
Function at 0x3001226e
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov eax, 0x11264
lea ebp, [esp - 0x111e4]
call fcn.3001fd80
mov eax, dword [0x30034b3c]
push esi
push edi
push 0x30003d90
mov dword [ebp + 0x111e0], eax
call fcn.300105be
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
push 0x105
lea eax, [ebp + 0x10fd4]
push eax
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x40
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test edi, edi
je 0x30012369
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + 0x10fd4]
push eax
call esi
cmp edi, eax
jne 0x30012369
push 0x800
lea eax, [ebp - 0x2c]
push eax
push 0x46
call fcn.3001074b
mov edi, eax
test edi, edi
je 0x30012362
lea eax, [ebp - 0x2c]
push eax
call esi
cmp edi, eax
jne 0x30012362
mov esi, 0x300564c8
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x10fd4]
push eax
push 0x30003d74
lea eax, [ebp + 0xfd4]
push 0x8000
push eax
call fcn.3000def7
add esp, 0x18
mov dword [0x30076d5c], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push 0
push 0x20
push 1
push 0
push 0
lea eax, [ebp + 0xfd4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x3001235b
xor eax, eax
jmp 0x30012378
push 0x30003d38
jmp 0x3001236e
push 0x30003cd8
jmp 0x3001236e
push 0x30003c68
call fcn.300105be
mov eax, 0xffffff2f
mov ecx, dword [ebp + 0x111e0]
pop edi
pop esi
call fcn.3001fd67
add ebp, 0x111e4
leave
ret
Function at 0x30012919
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0x400
lea edi, [esi + esi]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 8]
mov ebx, eax
push esi
push ebx
push 0x30003f68
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
add esi, 0xfffffffe
cmp eax, esi
jb 0x30012961
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x8000
jle 0x30012924
xor eax, eax
jmp 0x30012a09
xor edi, edi
cmp ebx, edi
je 0x3001295a
mov esi, ebx
mov ax, word [esi]
cmp ax, di
je 0x300129a5
cmp ax, 0x3b
je 0x30012996
push 0x30003f48
call fcn.300105be
push esi
call fcn.300105be
push 0x30076d54
push esi
call fcn.30011ec0
test eax, eax
jne 0x3001295a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jne 0x30012969
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x30077200], edi
jne 0x300129fc
cmp dword [0x300771f8], edi
jne 0x300129fc
cmp dword [0x300771fc], edi
jne 0x300129fc
cmp dword [0x30077204], edi
jne 0x300129fc
lea eax, [ebp + 8]
push eax
push 1
push 0xa
push 0x30077208
push 0x30003f20
mov dword [ebp + 8], edi
call fcn.3001250e
cmp dword [ebp + 8], edi
je 0x30012a06
push 0x30076d50
push 0x30003f30
call fcn.30011ec0
jmp 0x30012a06
mov dword [0x3007721c], 1
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x30012cfd
Capabilities:
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x30034b3c]
push esi
push edi
lea ecx, [ebp - 0x7c]
mov dword [ebp + 0x198], eax
call fcn.3000d430
mov esi, 0x105
push esi
mov edi, 0x300564c8
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x30012d45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x30012e9c
push ebx
push edi
push esi
push 0x30077298
call fcn.3000d4b9
push 0x5c
push edi
mov dword [0x30076d5c], eax
call fcn.3001624c
push edi
push 0x300043d0
mov ebx, eax
call fcn.300106d0
test ebx, ebx
pop ecx
pop ecx
je 0x30012d8a
and word [ebx], 0
add ebx, 2
push ebx
push esi
push 0x300562b8
call fcn.3000d4b9
mov dword [0x30076d5c], eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.3000d531
test eax, eax
mov dword [ebp - 0x80], eax
mov ebx, 0x300043b4
jne 0x30012e17
push dword [0x30076d54]
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.30011ffa
cmp dword [ebp - 0x78], 0
je 0x30012dd9
lea ecx, [ebp - 0x7c]
call fcn.3000d772
push dword [ebp - 0x7c]
push esi
push edi
call fcn.3000d4b9
push edi
push 0x30004384
mov dword [0x30076d5c], eax
call fcn.300106d0
pop ecx
pop ecx
push dword [0x30076d54]
lea eax, [ebp - 0x7c]
push eax
push 0x30004368
call fcn.30011ffa
cmp dword [ebp - 0x78], 0
je 0x30012e17
push dword [ebp - 0x7c]
push esi
push 0x300562b8
call fcn.3000d4b9
push 0x300562b8
push 0x30004340
mov dword [0x30076d5c], eax
call fcn.300106d0
pop ecx
pop ecx
cmp dword [0x30076f90], 0
jne 0x30012e91
push esi
push edi
call fcn.3000e2e1
test eax, eax
mov dword [ebp - 0x80], eax
je 0x30012e3b
push 0x30004300
call fcn.30010597
pop ecx
jmp 0x30012e98
push edi
push ebx
push 0x300042f4
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.3000def7
add esp, 0x14
mov dword [0x30076d5c], eax
mov ebx, 0x30076d50
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.30011ec0
push 0x300562b8
push 0x30004368
push 0x300042f4
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.3000def7
add esp, 0x14
mov dword [0x30076d5c], eax
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.30011ec0
mov dword [ebp - 0x80], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [ebp - 0x80]
pop ebx
lea ecx, [ebp - 0x7c]
call fcn.3000d43a
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, esi
pop esi
call fcn.3001fd67
add ebp, 0x19c
leave
ret
Function at 0x30013683
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x30004f14
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], edi
call fcn.30016e32
push edi
call fcn.3001a4b0
cmp dword [ebp + 8], edi
mov ebx, eax
je 0x300136bd
mov ebx, dword [ebp + 8]
cmp word [0x300360a8], di
jne 0x30013718
call fcn.3000eed7
test eax, eax
je 0x30013718
mov esi, 0x30076b00
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [eax*2 + 0x30076afe], 0x5c
lea eax, [ebp - 0x2c]
push eax
push esi
jne 0x300136f2
push 0x3000213c
jmp 0x300136f7
push 0x30002130
push 0x105
push 0x300360a8
call fcn.3000def7
mov dword [0x30076d5c], eax
add esp, 0x14
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x30013779
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
push 0x30004f00
push esi
call dword [eax + 0x14]
cmp eax, edi
jl 0x30013779
mov eax, dword [ebp - 0x30]
cmp eax, edi
je 0x30013779
cmp word [eax + 0x104], di
je 0x30013779
cmp dword [0x30076f90], edi
jne 0x30013779
cmp dword [0x3003402c], edi
je 0x30013779
push dword [0x30034030]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x30013768
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x30]
push esi
add eax, 0x104
push eax
call fcn.300193c4
mov ebx, eax
push 0x30004ed0
call fcn.300105be
call fcn.30010608
push ebx
push 0x30004eac
call fcn.300106d0
cmp dword [0x30056af8], edi
pop ecx
pop ecx
je 0x300137ce
xor esi, esi
cmp dword [0x30056af4], edi
jle 0x300137bd
mov eax, dword [0x30056af8]
push dword [eax + esi*4]
call fcn.3002244a
inc esi
cmp esi, dword [0x30056af4]
jl 0x300137a7
push dword [0x30056af8]
call fcn.3001fa19
mov dword [0x30056af8], edi
cmp dword [0x300771d0], edi
je 0x300137db
call fcn.3001f9d4
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.3001fd67
leave
ret 0xc
Function at 0x30013cec
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
push 0x30005050
mov dword [ebp + 0x194], eax
call fcn.300105be
push dword [ebp + 0x1a0]
call fcn.300105be
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x1a0]
xor esi, esi
mov dword [ebp - 0x80], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, dword [ebp + 0x1a8]
mov ebx, dword [ebp + 0x1ac]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [edi], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], esi
mov dword [ebx], esi
mov dword [ebp - 0x70], eax
mov esi, ecx
test esi, esi
jne 0x30013dc6
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x30005034
mov dword [ebp - 0x74], eax
call fcn.300105be
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push esi
push dword [ebp + 0x1a0]
call sub.VERSION.dll_GetFileVersionInfoW
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x30013e64
xor esi, esi
cmp dword [ebp + 0x1a4], esi
lea eax, [ebp - 0x70]
push eax
jne 0x30013de8
lea eax, [ebp - 0x7c]
push eax
push 0x30001940
push dword [ebp - 0x74]
mov dword [ebp - 0x70], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x30013dbe
cmp dword [ebp - 0x70], esi
je 0x30013dbe
mov eax, dword [ebp - 0x7c]
cmp eax, esi
jne 0x30013e1a
xor esi, esi
inc esi
jmp 0x30013e64
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x30013e73
call edi
push eax
push 0x30005004
call fcn.30010642
jmp 0x30013e73
lea eax, [ebp - 0x78]
push eax
push 0x300028a0
push dword [ebp - 0x74]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x30013dbe
cmp dword [ebp - 0x70], esi
je 0x30013dbe
cmp dword [ebp - 0x78], esi
je 0x30013dbe
push ebx
push edi
push dword [ebp - 0x78]
call fcn.30010b86
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x30013e24
mov ecx, dword [eax + 0x10]
mov dword [edi], ecx
mov eax, dword [eax + 0x14]
mov dword [ebx], eax
test esi, esi
jne 0x30013e64
movzx eax, word [ebx]
push eax
movzx eax, word [ebx + 2]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
push dword [ebp + 0x1a0]
lea eax, [ebp - 0x6c]
push 0x30004fd0
push 0xff
push eax
call fcn.3000def7
mov dword [0x30076d5c], eax
add esp, 0x20
lea eax, [ebp - 0x6c]
push eax
call fcn.300105be
cmp dword [ebp - 0x74], 0
je 0x30013e73
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 0x194]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebx
call fcn.3001fd67
add ebp, 0x198
leave
ret 0x10
Function at 0x300149c1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
push dword [0x30076d54]
mov edi, 0x30002750
push edi
mov dword [ebp - 4], eax
mov esi, 0x400
call fcn.30010e53
test eax, eax
jne 0x30014aee
push dword [0x30076d50]
push edi
call fcn.30010e53
test eax, eax
jne 0x30014aee
cmp dword [0x3007723c], eax
jne 0x30014aee
lea edi, [esi + esi]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 8]
mov ebx, eax
push esi
push ebx
push 0x30005530
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
add esi, 0xfffffffe
cmp eax, esi
jb 0x30014a4b
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x8000
jle 0x30014a13
jmp 0x30014a4f
test ebx, ebx
jne 0x30014a56
xor eax, eax
jmp 0x30014b02
mov esi, ebx
mov dword [ebp + 8], 1
mov edi, 0x105
test esi, esi
je 0x30014ae2
mov ax, word [esi]
test ax, ax
je 0x30014ae2
cmp ax, 0x3b
je 0x30014acb
push 0x3d
push esi
call fcn.3001621d
mov esi, eax
test esi, esi
je 0x30014adc
inc esi
inc esi
push esi
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.3000d4b9
mov dword [0x30076d5c], eax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.3000e757
push 0x3000550c
call fcn.300105be
lea eax, [ebp - 0x210]
push eax
call fcn.300105be
lea eax, [ebp - 0x210]
push eax
call fcn.3001494b
mov dword [ebp + 8], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp dword [ebp + 8], 0
jne 0x30014a64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
jmp 0x30014b02
push 0x30056b00
push 0x30005488
call fcn.300106d0
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001fd67
leave
ret 4
Function at 0x30014c7e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x30034b3c]
push ebx
push esi
xor ebx, ebx
cmp dword [0x30077238], ebx
push edi
mov dword [ebp + 0x194], eax
mov edi, 0x105
mov esi, 0x300566d8
jne 0x30014ced
push edi
push esi
call fcn.3000e757
test eax, eax
je 0x30014ced
push 0x5c
push esi
call fcn.3001621d
test eax, eax
jne 0x30014ced
push esi
push 0x300564c8
push 0x30002130
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.3000def7
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push edi
push esi
call fcn.3000d4b9
mov dword [0x30076d5c], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x30014deb
push 0x3000567c
call fcn.300105be
push esi
call fcn.300105be
cmp dword [0x300771e0], ebx
jne 0x30014dc0
call fcn.300110f3
test eax, eax
jne 0x30014dc0
push edi
mov ebx, 0x30076d78
push ebx
push 0x300021a4
push 0x30002bb8
push 0x30002b24
call fcn.30010b2b
test eax, eax
je 0x30014dc0
lea ecx, [ebp - 0x80]
call fcn.3000d430
push ebx
lea ecx, [ebp - 0x80]
call fcn.3000d622
test eax, eax
je 0x30014d65
push 0x5c
push 0
call fcn.3000d8cd
jmp 0x30014d97
lea eax, [ebp - 0x80]
push eax
call fcn.3000e81a
test eax, eax
je 0x30014d7e
push esi
push 0x58
push 0
call fcn.3000e13d
jmp 0x30014d97
push dword [ebp - 0x80]
push edi
push ebx
call fcn.3000d4b9
test eax, eax
jge 0x30014da1
push 0x30005628
call fcn.300106d0
pop ecx
lea ecx, [ebp - 0x80]
call fcn.3000d43a
jmp 0x30014dfe
push ebx
push 0x300055f8
call fcn.300106d0
pop ecx
pop ecx
lea ecx, [ebp - 0x80]
mov dword [0x300771e0], 1
call fcn.3000d43a
push esi
call fcn.300149c1
test eax, eax
jne 0x30014dcf
push esi
push 0x5a
jmp 0x30014de2
push dword [ebp + 0x1a0]
push esi
call fcn.30012919
test eax, eax
jne 0x30014de6
push esi
push 0x5b
push 0
jmp 0x30014df9
xor eax, eax
inc eax
jmp 0x30014e00
push 0x300055c8
call fcn.300105be
push esi
push 0x3f
push ebx
call fcn.3000e13d
xor eax, eax
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
pop ebx
call fcn.3001fd67
add ebp, 0x198
leave
ret 4
Function at 0x3001592b
Capabilities:
Accept command line arguments
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xac
mov eax, dword [0x30034b3c]
push ebx
push esi
mov dword [ebp + 0x70], eax
xor ebx, ebx
xor esi, esi
call fcn.3001f9d1
cmp eax, ebx
jge 0x3001596a
push eax
push 0x30001420
call fcn.30010597
push 0x30005cd4
call fcn.30010597
add esp, 0xc
jmp 0x30015b2a
mov dword [0x300771d0], 1
call fcn.30010c69
cmp dword [0x30076d68], 0x1f4
jae 0x3001599e
push 0x300043f0
push 0x47e
call fcn.300106f7
mov eax, 0xffffff37
jmp 0x30015b2c
call fcn.3001a225
call fcn.30019f65
mov eax, dword [ebp + 0x7c]
mov dword [0x30076d60], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x30056af4
push eax
mov dword [0x30077294], eax
call fcn.3001091d
push 0x30005c58
mov dword [0x30056af8], eax
call fcn.300105be
call fcn.30010608
push 0x105
push 0x300564c8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x300159fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x30015b2c
call fcn.3001119e
call fcn.30011258
cmp dword [0x300771e8], ebx
je 0x30015a5b
call fcn.3001cd1e
test eax, eax
jne 0x30015a47
call fcn.3001cd47
test eax, eax
jne 0x30015a47
push 5
push ebx
call fcn.30010da3
test eax, eax
jne 0x30015a47
push 0xc
push ebx
call fcn.30010da3
test eax, eax
jne 0x30015a47
call fcn.3001134a
test eax, eax
jne 0x30015a47
cmp dword [0x300771ec], ebx
je 0x30015a5b
push 0x30005c24
call fcn.300105be
mov eax, 0xffffff38
jmp 0x30015b2c
call fcn.30011298
call fcn.300137ec
test eax, eax
jne 0x30015a8d
push 0x30005bd8
call fcn.300105be
cmp dword [0x300771e8], ebx
jne 0x30015a83
push 0x32
push ebx
call fcn.3000d8cd
mov eax, 0xffffff33
jmp 0x30015b2c
call fcn.30010c69
call fcn.30011635
push 0x30002a20
push 0x51
lea eax, [ebp - 0x34]
push eax
push 0xfffffc17
call fcn.3001a986
mov esi, eax
cmp esi, ebx
jne 0x30015ae9
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.30019b98
mov esi, eax
cmp esi, ebx
jne 0x30015ae9
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x38], ebx
jne 0x30015ae9
lea eax, [ebp - 0x34]
push eax
push dword [0x300340d0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push edi
xor eax, eax
cmp esi, ebx
mov ecx, 0x1076
mov edi, 0x300774b0
rep stosd dword es:[edi], eax
pop edi
je 0x30015b09
push 0x30005b78
call fcn.300105be
jmp 0x30015b2a
call fcn.30011712
test eax, eax
jne 0x30015b19
mov eax, 0xfffffe6b
jmp 0x30015b2c
push 0x30076d50
push 0x30005b4c
call fcn.30011ec0
mov esi, eax
mov eax, esi
mov ecx, dword [ebp + 0x70]
pop esi
pop ebx
call fcn.3001fd67
add ebp, 0x74
leave
ret 4