joyce8/EMBER2024-capa huggingface dataset:
Function at 0x300514bf
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0
je 0x300514e7
mov eax, dword [esi + 0x28]
mov edx, dword [esi]
push edi
mov edi, dword [eax]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [esi + 0x28]
mov edx, dword [edi + 0x18]
push eax
call edx
pop edi
mov ecx, esi
pop esi
jmp fcn.30050fd1
pop esi
ret

Function at 0x30055700
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
push 0x300557c8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x30055787
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x3003f034
mov esi, 4
push ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3005577d
cmp dword [ebp - 0x10], esi
jne 0x3005577d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x14], eax
jne 0x3005577d
mov eax, dword [ebp - 8]
push esi
lea edx, [ebp - 0x18]
push edx
push esi
push 0
push 0x300557b0
push eax
mov dword [ebp - 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ONMain.DLL_struct_MsoCF::AErrorHandler____stdcall_MsoCF::TheErrorHandler_void_]
call esi
test eax, eax
je 0x300557a5
call esi
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [ebp - 1]
push ecx
mov ecx, dword [ebp + 8]
push ecx
push eax
call edx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x30055cfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.MSO.dll_Ordinal_9705]
test eax, eax
je 0x30055d6a
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push 0x30055dd0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x30055d7d
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push eax
push eax
mov eax, dword [ebp - 8]
push 0x30055d94
push eax
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30055d5a
xor eax, eax
cmp dword [ebp - 4], 1
sete al
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0x30055d84
call dword [sym.imp.MSO.dll_Ordinal_1605]
test eax, eax
jne 0x30055d4d
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x30058716
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea edx, [ebp - 0x210]
push edx
push 0x2001f
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
push 0
push ecx
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x208]
mov esi, eax
test esi, esi
jne 0x30058791
test ecx, ecx
je 0x3005877f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [ebp - 0x210]
mov esi, eax
mov dword [ebp - 0x208], ecx
je 0x3005879f
test ecx, ecx
je 0x30058865
push ecx
jmp 0x3005885f
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x204]
push eax
push 0
push ecx
mov dword [ebp - 0x20c], 0x100
call esi
test eax, eax
jne 0x30058827
lea ecx, [ecx]
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x208]
call fcn.30058716
mov edi, eax
test edi, edi
jne 0x30058879
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x208]
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x204]
push ecx
push edi
push edx
mov dword [ebp - 0x20c], 0x100
call esi
test eax, eax
je 0x300587d5
mov edi, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x30058842
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x218]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x30058865
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x3005888a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4
Function at 0x30059c28
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 4]
push eax
push ebx
mov esi, ecx
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp byte [esi + 0x6d], 0
mov edi, eax
je 0x30059c99
xor esi, esi
cmp dword [ebp - 4], esi
jle 0x30059c8e
mov ebx, dword [sym.imp.MSO.dll_Ordinal_639]
mov ecx, dword [edi + esi*4]
push 1
push 0x3001fc5c
push ecx
call ebx
test eax, eax
jne 0x30059c86
mov edx, dword [edi + esi*4]
movzx eax, word [edx]
cmp ax, 0x2f
je 0x30059d15
cmp ax, 0x2d
je 0x30059d15
add esi, 1
cmp esi, dword [ebp - 4]
jl 0x30059c5b
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0xd8], 0
je 0x30059d15
test ebx, ebx
je 0x30059d15
cmp dword [ebp - 4], 0
jle 0x30059cc7
mov ecx, dword [edi]
movzx eax, word [ecx]
cmp ax, 0x2f
je 0x30059cc7
cmp ax, 0x2d
je 0x30059cc7
push ecx
call fcn.300177fc
test al, al
jne 0x30059d15
xor esi, esi
cmp dword [ebp - 4], esi
mov byte [ebp + 0xb], 0
jle 0x30059d09
mov ebx, dword [sym.imp.MSO.dll_Ordinal_639]
mov eax, dword [edi + esi*4]
push 1
push 0x3001fc44
push eax
call ebx
test eax, eax
je 0x30059cef
mov byte [ebp + 0xb], 1
jmp 0x30059d01
mov ecx, dword [edi + esi*4]
movzx eax, word [ecx]
cmp ax, 0x2f
je 0x30059d15
cmp ax, 0x2d
je 0x30059d15
add esi, 1
cmp esi, dword [ebp - 4]
jl 0x30059cd8
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3005a03c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009aea2
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
call dword [str.5D_t0h__t0]
xor eax, eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x418], eax
push 2
push eax
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x420], edi
jne 0x3005a0c7
call fcn.30057f39
mov esi, eax
jmp 0x3005a1d2
mov ecx, dword [ebp - 0x41c]
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x3005a0e6
call fcn.30057f39
jmp 0x3005a1c9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x428], eax
jne 0x3005a102
call fcn.30057f39
jmp 0x3005a1c9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x41c], esi
jae 0x3005a147
lea edx, [ebp - 0x414]
cmp dword [ebp - 0x418], edx
je 0x3005a132
lea ecx, [ebp - 0x418]
call fcn.300586e3
lea ecx, [ebp - 0x424]
call fcn.3005867f
mov eax, 0x8007000e
jmp 0x3005a1ee
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.30058c5f
mov dword [ebp - 4], 1
jmp 0x3005a172
mov ebx, dword [ebp - 0x418]
test ebx, ebx
jne 0x3005a183
mov esi, 0x8007000e
jmp 0x3005a1cb
call dword [str.5D_t0h__t0]
mov ecx, dword [ebp - 0x428]
push esi
push ebx
push esi
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x3005a1a7
call fcn.30057f39
jmp 0x3005a1c9
mov edx, dword [ebp - 0x418]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x418]
push eax
push ecx
lea ecx, [ebp - 0x430]
call fcn.30059a64
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x414]
cmp dword [ebp - 0x418], edx
je 0x3005a1ec
lea ecx, [ebp - 0x418]
call fcn.300586e3
nop
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret 0x10
Function at 0x3005ad46
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009b05c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.ONMain.DLL_class_MsoCF::CHeapBufferAllocator_MsoCF::g_HeapBufferAllocator]
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push edi
mov dword [ebp - 4], edi
call esi
push edi
cdq
push 4
push edx
push eax
call fcn.30005528
mov ecx, eax
add ecx, 0x80000000
adc edx, edi
cmp edx, edi
ja 0x3005ae5a
jb 0x3005adb3
cmp ecx, 0xffffffff
ja 0x3005ae5a
cmp eax, dword [ebp - 0x10]
jle 0x3005adc8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, dword [edx]
call ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push edx
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
call esi
mov bx, word [ebp + 0xc]
mov edi, dword [sym.imp.MSO.dll_Ordinal_1921]
mov ecx, dword [ebp - 0x14]
xor esi, esi
mov eax, dword [ebp - 0x10]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp esi, eax
jge 0x3005ae3e
cmp bx, word [ecx + esi*4]
jne 0x3005ae0e
mov eax, dword [ecx + esi*4]
push eax
call edi
cmp eax, 1
mov ecx, dword [ebp - 0x14]
je 0x3005ae13
add esi, 1
jmp 0x3005adea
mov edx, dword [ecx + esi*4]
push 0
push edx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov eax, dword [ebp - 0x14]
push eax
call sub.ONMain.DLL_void___stdcall_MsoCF::Memory::Allocator::Free_void__
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ecx
call sub.ONMain.DLL_void___stdcall_MsoCF::Memory::Allocator::Free_void__
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.30041ede
int3
Function at 0x30060a74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3009cbc8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
shr ecx, 0x10
movsx ecx, cx
movsx eax, di
push ecx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edx, dword [esi + 4]
mov ebx, eax
push ebx
push edx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x30060afb
mov ecx, dword [esi + 0x110]
call dword [sym.imp.MSO.dll_Ordinal_4416]
test al, al
je 0x30060afb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
movsx eax, ax
setg bl
add eax, dword [0x300b8008]
mov ecx, 0x78
cdq
xor eax, edx
sub eax, edx
cdq
idiv ecx
test bl, bl
mov edi, eax
jne 0x30060b25
neg edx
push 0x11
mov dword [0x300b8008], edx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0xf0]
test ax, ax
setl al
test al, al
mov byte [ebp + 0xf], al
je 0x30060b4d
call fcn.30013793
jmp 0x30060b52
call fcn.3000c292
test bl, bl
je 0x30060b5a
sub eax, edi
jmp 0x30060b5c
add eax, edi
cmp eax, 1
mov edi, 1
jl 0x30060b68
mov edi, eax
mov ecx, dword [esi + 0xf0]
call fcn.3000c20d
cmp eax, edi
jge 0x30060b79
mov edi, eax
cmp byte [ebp + 0xf], 0
mov ecx, dword [esi + 0xf0]
je 0x30060be9
call fcn.3000c20d
xor ebx, ebx
cmp eax, ebx
je 0x30060c0b
cmp eax, edi
jge 0x30060b96
mov edi, eax
cmp edi, 1
jge 0x30060ba0
mov edi, 1
cmp edi, dword [esi + 0x54]
je 0x30060c0b
mov dword [esi + 0x54], edi
mov dword [ebp + 0xc], ebx
mov ecx, dword [esi + 0xf0]
lea edx, [ebp + 0xc]
push edx
push edi
mov dword [ebp - 4], ebx
call fcn.3007009c
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x30060bd4
mov eax, dword [ecx]
mov edx, dword [eax + 0x98]
push 1
call edx
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
mov dword [ebp - 4], 0xffffffff
je 0x30060c0b
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
jmp 0x30060c0b
call fcn.3000c292
cmp edi, eax
je 0x30060c0b
mov ecx, dword [esi + 0xf0]
push 0
call fcn.3000f232
mov ecx, dword [esi + 0xf0]
push edi
call fcn.300136c8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x3007ed6f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x300a1bb6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.ONMain.DLL_class_MsoCF::CHeapBufferAllocator_MsoCF::g_HeapBufferAllocator]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
push ebx
push esi
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ONMain.DLL_void___stdcall_MsoCF::Strings::CopyWzToWz_wchar_t_const___class_MsoCF::CWzInBuffer_T_class_MsoCF::String_struct_MsoCF::WzTraits___class_MsoCF::CBuffer_wchar_t_____int__]
mov ecx, dword [sym.imp.ONMain.DLL_class_MsoCF::CHeapBufferAllocator_MsoCF::g_HeapBufferAllocator]
lea eax, [esi + 0xc]
mov dword [ebp - 4], 1
mov dword [ebp + 8], eax
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov ecx, dword [edi + 0x10]
push ebx
push eax
push ecx
mov byte [ebp - 4], 2
call dword [sym.imp.ONMain.DLL_void___stdcall_MsoCF::Strings::CopyWzToWz_wchar_t_const___class_MsoCF::CWzInBuffer_T_class_MsoCF::String_struct_MsoCF::WzTraits___class_MsoCF::CBuffer_wchar_t_____int__]
mov edx, dword [sym.imp.ONMain.DLL_class_MsoCF::CHeapBufferAllocator_MsoCF::g_HeapBufferAllocator]
lea eax, [esi + 0x18]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov ecx, dword [edi + 0x1c]
push ebx
push eax
push ecx
mov byte [ebp - 4], 4
call dword [sym.imp.ONMain.DLL_void___stdcall_MsoCF::Strings::CopyWzToWz_wchar_t_const___class_MsoCF::CWzInBuffer_T_class_MsoCF::String_struct_MsoCF::WzTraits___class_MsoCF::CBuffer_wchar_t_____int__]
mov ecx, dword [sym.imp.ONMain.DLL_class_MsoCF::CHeapBufferAllocator_MsoCF::g_HeapBufferAllocator]
lea eax, [esi + 0x24]
mov dword [ebp + 8], eax
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov ecx, dword [edi + 0x28]
push ebx
push eax
push ecx
mov byte [ebp - 4], 6
call dword [sym.imp.ONMain.DLL_void___stdcall_MsoCF::Strings::CopyWzToWz_wchar_t_const___class_MsoCF::CWzInBuffer_T_class_MsoCF::String_struct_MsoCF::WzTraits___class_MsoCF::CBuffer_wchar_t_____int__]
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
mov eax, dword [edi + 0x38]
cmp eax, ebx
je 0x3007ee4f
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
mov eax, dword [edi + 0x3c]
cmp eax, ebx
je 0x3007ee67
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x30081704
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x300a22b3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSO.dll_Ordinal_137]
mov dword [esi], 0x30081858
xor ebx, ebx
mov dword [esi + 0x9c], 0x30081850
mov dword [ebp - 4], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], 0x80000000
mov dword [esi + 0xb8], 0x48
lea edi, [esi + 0xd0]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [esi + 0xc0], 0x30081854
call fcn.3007ee8c
fldz
fstp dword [edi + 0x48]
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x5c], 0x28
mov eax, 0x80000000
mov dword [edi + 0x58], eax
mov dword [edi + 0x68], eax
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x6c], 0x78
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x140], 2
mov byte [esi + 0x144], 1
mov dword [esi + 0x148], 3
mov byte [esi + 0x14c], bl
mov dword [esi + 8], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x30088eea
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x300a2eec
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x3002dd90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 0x24]
push 0x30088174
mov ecx, edi
mov dword [esi], 0x30021df8
call fcn.30013bd3
mov ecx, edi
call fcn.30013b3f
lea ecx, [esi + 0x4c]
call fcn.3001cf6d
lea ecx, [esi + 0x3c]
call fcn.3001cf6d
lea ebx, [esi + 0x30]
push 0x3007aa07
mov ecx, ebx
call fcn.30013bd3
mov ecx, ebx
call fcn.30013b3f
mov ecx, ebx
call fcn.30013b3f
push 0x30088174
mov ecx, edi
call fcn.30013bd3
mov ecx, edi
call fcn.30013b3f
mov ecx, edi
call fcn.30013b3f
mov dword [esi], 0x3001e9d0
mov eax, dword [esi + 0xc]
test eax, eax
mov dword [ebp - 4], 0
je 0x30088f94
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSO.dll_Ordinal_2234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3008c2ee
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x300a34b9
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [sym.imp.ONMain.DLL_class_MsoCF::CFastBufferAllocator_MsoCF::g_FastBufferAllocator]
mov eax, 0x102
lea edx, [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], eax
xor edi, edi
mov word [ebp - 0x114], di
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x124]
push edx
mov edx, dword [esi + 0x38]
push edx
mov edx, dword [esi + 0x30]
push edx
mov dword [ebp - 4], 1
call eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], edi
push eax
mov edi, eax
call dword [sym.imp.MSO.dll_Ordinal_295]
lea eax, [eax + eax + 2]
push eax
push edi
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.ONMain.DLL_void___stdcall_MsoCF::ProduceAtom_class_MsoCF::IAtom____void_const___int_]
mov dword [ebp - 0x12c], 0x687003a
mov ecx, dword [esi + 0xc]
push 1
mov byte [ebp - 4], 2
call fcn.3004c2f7
mov edx, dword [ebp - 0x12c]
mov esi, eax
push edx
lea eax, [ebp - 0x134]
push eax
push 0x1c00141d
call dword [sym.imp.ONMain.DLL_struct_MsoCF::PropertyInfo_const____stdcall_MsoCF::LookupProperty_unsigned_int_]
push eax
push esi
call dword [sym.imp.ONMain.DLL_void___stdcall_MsoCF::Properties::Set_struct_MsoCF::IPropertySet___struct_MsoCF::PropertyInfo_const___void_const___enum_MsoCF::PropertyType_]
mov eax, dword [ebp - 0x12c]
mov ecx, eax
shr ecx, 0x19
test cl, 1
mov byte [ebp - 4], 1
je 0x3008c3fa
push eax
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.ONMain.DLL_public:_static_void___stdcall_MsoCF::CPropertyData::FreeAndZero_ComplexType_void___enum_MsoCF::PropertyType_]
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x114]
cmp eax, ecx
je 0x3008c410
push eax
call sub.ONMain.DLL_void___stdcall_MsoCF::Memory::Allocator::Free_void__
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret

Function at 0x30093784
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x300937ec
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x300937dc
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push 0x300937e4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x300937dc
mov al, 1
jmp 0x300937de
xor al, al
leave
ret 8
Function at 0x30096d71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x30096de0
mov eax, dword [ebp + 8]
test eax, 3
je 0x30096da2
cmp word [eax], 0
je 0x30096d9b
lea eax, [eax + 2]
test eax, 3
jne 0x30096d89
jmp 0x30096da2
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30096ddd
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x30096da2
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30096ddd
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30096ddd
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x30096da2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4