joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30022f89
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x8ec]
sub esp, 0x96c
mov eax, dword [section..cdata]
push ebx
push edi
mov dword [ebp + 0x8e8], eax
push 0xf
xor eax, eax
cmp dword [ebp + 0x8f4], 0
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x7e4]
mov dword [ebp - 0x44], 0x824
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0x104
jne 0x30022fdc
xor eax, eax
jmp 0x300230e9
push esi
mov esi, 0x10000000
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0x8f4]
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
je 0x300230e6
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x300230e6
cmp dword [ebp - 0x74], 3
je 0x30023029
cmp dword [ebp - 0x74], 4
jne 0x300230e6
push dword [ebp - 0x70]
call fcn.3004e915
mov esi, 0x30002d70
push esi
mov ebx, eax
call fcn.3004e915
push eax
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.30032b9d
test eax, eax
je 0x30023067
mov esi, 0x30002d78
push esi
call fcn.3004e915
push eax
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.30032b9d
test eax, eax
jne 0x300230e6
push esi
call fcn.3004e915
lea eax, [ebp + eax - 0x40]
jmp 0x30023078
test cl, cl
je 0x300230e6
inc eax
mov cl, byte [eax]
cmp cl, 0x2f
jne 0x30023073
test cl, cl
je 0x300230e6
mov eax, dword [ebp - 0x70]
mov edi, 0x30003170
push edi
lea esi, [ebx + eax]
call fcn.3004e915
cmp ebx, eax
jl 0x300230a8
push eax
mov ecx, esi
push edi
sub ecx, eax
push ecx
call fcn.30032b9d
test eax, eax
je 0x300230e1
mov edi, 0x30003164
push edi
call fcn.3004e915
cmp ebx, eax
jl 0x300230c5
push eax
push edi
sub esi, eax
push esi
call fcn.30032b9d
test eax, eax
je 0x300230e1
mov esi, 0x30003154
push esi
call fcn.3004e915
cmp ebx, eax
jne 0x300230e6
push esi
push dword [ebp - 0x70]
call fcn.300329d8
test eax, eax
jne 0x300230e6
xor eax, eax
inc eax
jmp 0x300230e8
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x8e8]
pop edi
pop ebx
call fcn.30062f67
add ebp, 0x8ec
leave
ret 4
Function at 0x30023552
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x30023643
cmp dword [ebp + 8], ebx
je 0x30023643
push 0x106
push 0x10000
call fcn.3005408c
mov edx, eax
xor eax, eax
cmp edx, ebx
mov dword [ebp - 8], edx
je 0x30023645
push edi
push 0x8000
push edx
push dword [ebp + 8]
mov edi, edx
mov ecx, 0x4000
rep stosd dword es:[edi], eax
call fcn.300234ff
test eax, eax
pop edi
je 0x30023637
push esi
push ebx
push ebx
push 4
push dword [ebp + 0x10]
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x30023601
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [ebp - 0xc], eax
je 0x300235e5
cmp eax, 0x21
je 0x300235e5
cmp eax, 0x36
jne 0x30023636
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x300235f9
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0x32
jl 0x300235b0
jmp 0x30023636
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.3004e99c
add eax, eax
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
pop esi
push dword [ebp - 8]
call fcn.30053fa1
mov eax, ebx
jmp 0x30023645
xor eax, eax
pop ebx
leave
ret 0xc

Function at 0x3002364a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov dword [ebp - 4], ebx
je 0x30023733
cmp dword [ebp + 8], ebx
je 0x30023733
push 0x106
mov esi, 0x8000
push esi
call fcn.3005408c
mov edx, eax
xor eax, eax
cmp edx, ebx
mov dword [ebp - 8], edx
je 0x30023735
push edi
push esi
push edx
push dword [ebp + 8]
mov edi, edx
mov ecx, 0x2000
rep stosd dword es:[edi], eax
call fcn.300234ab
test eax, eax
pop edi
je 0x30023727
push ebx
push ebx
push 4
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x300236f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [ebp - 0xc], eax
je 0x300236d8
cmp eax, 0x21
je 0x300236d8
cmp eax, 0x36
jne 0x30023727
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x300236ec
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0x32
jl 0x300236a5
jmp 0x30023727
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.3004e915
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call fcn.30053fa1
mov eax, ebx
jmp 0x30023735
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x30023c44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [section..cdata]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x1c], 0x3a
mov word [ebp - 0x1a], 0x5c
mov word [ebp - 0x18], 0x2f
mov word [ebp - 0x16], 0x3c
mov word [ebp - 0x14], 0x3e
mov word [ebp - 0x12], 0x22
mov word [ebp - 0x10], 0x7c
mov word [ebp - 0xe], 0x2a
mov word [ebp - 0xc], 0x3f
mov word [ebp - 0xa], 0x26
mov word [ebp - 8], 0x2c
mov word [ebp - 6], 0x25
mov dword [ebp - 0x78], 0x300032e0
mov dword [ebp - 0x74], 0x300032d8
mov dword [ebp - 0x70], 0x300032d0
mov dword [ebp - 0x6c], 0x300032c0
mov dword [ebp - 0x68], 0x300032b8
mov dword [ebp - 0x64], 0x300032ac
mov dword [ebp - 0x60], 0x300032a0
mov dword [ebp - 0x5c], 0x30003294
mov dword [ebp - 0x58], 0x30003288
mov dword [ebp - 0x54], 0x3000327c
mov dword [ebp - 0x50], 0x30003270
mov dword [ebp - 0x4c], 0x30003264
mov dword [ebp - 0x48], 0x30003258
mov dword [ebp - 0x44], 0x3000324c
mov dword [ebp - 0x40], 0x30003240
mov dword [ebp - 0x3c], 0x30003234
mov dword [ebp - 0x38], 0x30003228
mov dword [ebp - 0x34], 0x3000321c
mov dword [ebp - 0x30], 0x30003210
mov dword [ebp - 0x2c], 0x30003204
mov dword [ebp - 0x28], 0x300031f8
mov dword [ebp - 0x24], 0x300031ec
mov dword [ebp - 0x20], 0x300031e0
xor ebx, ebx
jmp 0x30023d6f
mov ax, word [ecx]
xor edx, edx
cmp ax, word [ebp + edx*2 - 0x1c]
jne 0x30023d54
push 0x5f
pop eax
inc edx
cmp edx, 0xc
jl 0x30023d4a
cmp ax, bx
mov word [ecx], ax
jbe 0x30023d6d
cmp ax, 0x20
jae 0x30023d6d
mov word [ecx], 0x5f
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x30023d45
mov esi, dword [ebp + ebx*4 - 0x78]
push esi
call fcn.3004e99c
mov edi, eax
push edi
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.30032aba
test eax, eax
jne 0x30023d9e
mov di, word [esi + edi*2]
test di, di
je 0x30023da6
cmp di, 0x2e
je 0x30023da6
inc ebx
cmp ebx, 0x17
jl 0x30023d74
jmp 0x30023dab
mov word [esi], 0x58
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.30062f67
leave
ret 4

Function at 0x300247af
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x3009c3f0], 1
mov eax, dword [section..cdata]
mov dword [ebp - 4], eax
jb 0x300247d4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x30024840
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x3002483d
push edi
push dword [ebp + 8]
call fcn.3004e915
mov edi, eax
lea eax, [ebp - 0x108]
push eax
call fcn.3004e915
lea eax, [edi + eax + 2]
cmp eax, esi
pop edi
ja 0x3002483d
push esi
lea eax, [ebp - 0x108]
push eax
push 0x30002958
call fcn.3004fd45
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.3004fd45
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x3002483f
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.30062f67
leave
ret 4
Function at 0x300248fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x58], 0x44
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [0x3009a790]
push 0xfa0
mov dword [ebp - 4], ebx
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 8], ebx
je 0x3002497a
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [0x3009c3cc]
call edi
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
lea eax, [ebp - 4]
push eax
call fcn.30052e0e
test eax, eax
je 0x300249c3
push esi
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [0x3009c3cc]
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x3009a790]
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push dword [ebp - 4]
add eax, 0x258
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 4], ebx
mov esi, eax
je 0x300249af
push dword [ebp - 4]
call fcn.30052f09
cmp esi, ebx
je 0x300249c3
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x30024e1b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [section..cdata]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
je 0x30024fcc
test byte [ebp + 0xc], 8
je 0x30024fcc
lea eax, [ebp - 0x118]
push eax
call fcn.3001b85c
test eax, eax
je 0x30024fcc
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x118]
push eax
push 0x300035a8
call fcn.3004fd45
push esi
lea eax, [ebp - 0x118]
push eax
push 0x300035a0
call fcn.3004fd45
push 1
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
je 0x30024fca
push 0x30003588
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
je 0x30024fca
push dword [ebp + 8]
sub esi, edi
push ebx
push 0x43a
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x30024fca
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push edi
mov dword [ebp + 0xc], ebx
call dword [0x300a2ee8]
push 0x106
push dword [ebp + 0xc]
call fcn.3005408c
cmp eax, ebx
mov dword [ebp - 0x11c], eax
je 0x30024fc3
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push edi
call dword [0x300a2ee8]
test eax, eax
je 0x30024fb8
xor esi, esi
test dword [ebp + 0xc], 0xfffffffc
jbe 0x30024fb8
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x11c]
push dword [eax + esi*4]
push edi
call dword [0x300a2ef4]
test eax, eax
jle 0x30024f73
push 0x300035a0
lea eax, [ebp - 0x14]
push eax
call fcn.300329d8
test eax, eax
jne 0x30024f73
push 0xc
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x11c]
push dword [eax + esi*4]
push edi
call dword [0x300a2ef0]
test eax, eax
jne 0x30024f80
mov eax, dword [ebp + 0xc]
inc esi
shr eax, 2
cmp esi, eax
jb 0x30024f2a
jmp 0x30024fb8
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x120]
add eax, ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push ebx
push eax
push 0x10000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
cmp esi, ebx
je 0x30024fb8
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x11c]
call fcn.30053fa1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.30062f67
leave
ret 8
Function at 0x30025459
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [section..cdata]
mov dword [ebp + 0x9c], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0xac]
call fcn.3003312c
test eax, eax
je 0x300255e3
push edi
push 0x104
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x78]
call fcn.3004fcea
lea eax, [ebp - 0x68]
push eax
call fcn.30022dbd
mov edi, eax
cmp byte [edi], 0x5c
jne 0x300255e2
push ebx
lea eax, [ebp - 0x6c]
push eax
push 0x20019
xor ebx, ebx
push ebx
lea eax, [ebp - 0x68]
mov byte [edi], bl
push eax
push dword [ebp - 0x74]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x300255e1
push esi
mov esi, dword [ebp + 0xa8]
mov eax, dword [esi + 0xc]
sub eax, ebx
je 0x300255b2
dec eax
je 0x30025595
dec eax
je 0x3002557c
dec eax
jne 0x300255d7
push 1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], ebx
call fcn.3003287b
test eax, eax
je 0x300255d7
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x70]
push ebx
push ebx
call edi
mov dword [ebp + 0xac], eax
add eax, eax
push 0x106
push eax
mov dword [ebp + 0xa8], eax
call fcn.3005408c
cmp eax, ebx
mov dword [esi + 4], eax
je 0x3002556d
push dword [ebp + 0xac]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x70]
push ebx
push ebx
call edi
mov eax, dword [ebp + 0xa8]
mov dword [esi + 8], eax
mov dword [esi], 1
cmp dword [ebp - 0x70], ebx
je 0x300255d7
push dword [ebp - 0x70]
call fcn.30053fa1
jmp 0x300255d7
push 3
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x6c]
call fcn.3003287b
test eax, eax
je 0x300255d7
jmp 0x300255d1
xor ebx, ebx
inc ebx
push ebx
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x6c]
call fcn.3003287b
test eax, eax
je 0x300255d7
mov dword [esi], ebx
jmp 0x300255d7
lea eax, [ebp - 0x7c]
push eax
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x7c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x300255d7
mov dword [esi], 1
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp + 0x9c]
call fcn.30062f67
add ebp, 0xa0
leave
ret 8
Function at 0x300255f8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x30002d3c
call fcn.3003312c
test eax, eax
jne 0x30025616
leave
ret
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
xor esi, esi
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x3002563f
xor eax, eax
jmp 0x3002573a
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x30025670
inc dword [ebp - 0x10]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call fcn.30052e0e
test eax, eax
jne 0x3002567b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30025638
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
jbe 0x3002571f
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x300256f9
push dword [ebp - 8]
call fcn.30022571
test eax, eax
je 0x300256ec
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x300256ec
push 3
push 0x300665a0
push 0x3006659c
push 0x300667c0
push dword [ebp - 0x14]
call fcn.3003287b
test eax, eax
push dword [ebp - 0x14]
jne 0x3002570f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jb 0x30025687
jmp 0x3002571f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.30052f09
jmp 0x30025638
mov dword [0x30066598], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.30052f09
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3002581c
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [section..cdata]
push ebx
push esi
mov esi, dword [ebp + 0xa0]
imul esi, esi, 0x18
xor ebx, ebx
cmp dword [esi + 0x30066580], ebx
mov dword [ebp + 0x90], eax
je 0x30025860
mov eax, dword [esi + 0x30066584]
cmp eax, dword [ebp + 0xa4]
jne 0x30025860
xor eax, eax
inc eax
jmp 0x30025939
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x9c]
call fcn.3004fcea
mov eax, dword [esi + 0x30066590]
cmp eax, ebx
je 0x300258a3
cmp byte [eax], bl
je 0x300258a3
push edi
lea eax, [ebp - 0x74]
push eax
push 0x30002958
call fcn.3004fd45
push edi
lea eax, [ebp - 0x74]
push eax
push dword [esi + 0x30066590]
call fcn.3004fd45
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.3003312c
test eax, eax
jne 0x300258bc
xor eax, eax
jmp 0x30025938
push dword [ebp - 0x78]
call fcn.30022dbd
mov edi, eax
cmp byte [edi], 0x5c
jne 0x300258b8
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x20006
push ebx
push ebx
mov byte [edi], bl
push ebx
push dword [ebp - 0x78]
inc edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x300258b8
mov eax, dword [esi + 0x30066594]
cmp eax, ebx
je 0x300258fa
cmp byte [eax], bl
jne 0x300258fc
mov eax, edi
push 4
pop edi
push edi
lea ecx, [ebp + 0xa4]
push ecx
push edi
push ebx
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x300258b8
mov eax, dword [ebp + 0xa4]
mov dword [esi + 0x30066584], eax
xor eax, eax
inc eax
mov dword [esi + 0x30066588], edi
mov dword [esi + 0x30066580], eax
mov dword [esi + 0x3006658c], ebx
pop edi
mov ecx, dword [ebp + 0x90]
pop esi
pop ebx
call fcn.30062f67
add ebp, 0x94
leave
ret 0xc

Function at 0x3002599e
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7e4]
sub esp, 0x864
mov eax, dword [section..cdata]
push esi
mov esi, dword [ebp + 0x7ec]
test esi, esi
mov dword [ebp + 0x7e0], eax
je 0x30025a64
call fcn.30022c4c
test eax, eax
je 0x300259e9
push 0x300035ec
call fcn.30022ce6
push esi
call fcn.30022ce6
push 0x300029a0
call fcn.30022ce6
cmp dword [0x3009c3b4], 0
jne 0x300259fc
push esi
call fcn.30021e5c
test eax, eax
je 0x30025a06
push esi
call fcn.30021f0e
test eax, eax
jne 0x30025a64
push 0x824
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.3004fcea
cmp dword [ebp + 0x7f0], 0
je 0x30025a29
lea eax, [ebp - 0x44]
push eax
call fcn.3002206e
jmp 0x30025a64
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x64], 0xa
mov dword [ebp - 0x7c], 0x100
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
jne 0x30025a64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x7e0]
pop esi
call fcn.30062f67
add ebp, 0x7e4
leave
ret 8
Function at 0x30025d59
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x30025df0
push edi
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x30025def
push edi
call fcn.30022de2
cmp eax, edi
je 0x30025def
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
sub eax, edi
sar eax, 1
push eax
push edi
push esi
push dword [0x3009c3cc]
mov dword [ebp - 8], eax
call ebx
mov esi, eax
inc esi
push esi
lea eax, [ebp - 4]
push eax
call fcn.30052e0e
test eax, eax
je 0x30025dee
mov edi, dword [ebp - 4]
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
push eax
push dword [0x3009c3cc]
call ebx
test eax, eax
je 0x30025de6
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp - 4]
call fcn.30052f09
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x30025ee9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x30025efc
xor eax, eax
jmp 0x30025eff
and eax, 0x10
ret 4

Function at 0x30025fd6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x30025ffc
xor eax, eax
jmp 0x30026061
push ebx
push 0x106
push esi
call fcn.3005408c
mov ebx, eax
cmp ebx, edi
jne 0x30026012
xor eax, eax
jmp 0x30026060
push ebx
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x30026058
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x30002958
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x30026058
mov esi, dword [ebp - 0xc]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.30022544
test eax, eax
je 0x30026058
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0x14]
xor edi, edi
inc edi
and eax, edi
mov dword [ecx], eax
push ebx
call fcn.30053fa1
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 0x10