joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3007cbe7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x30187062
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x30024a78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov cl, byte [ebp + 0x10]
xor eax, eax
mov byte [esi + 0x14], cl
mov ecx, 1
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], edx
mov byte [esi + 0x15], al
mov dword [esi + 0x18], ecx
mov dword [esi], 0x30006180
mov byte [esi + 0x1c], al
mov byte [esi + 0x1d], al
mov byte [esi + 0x1e], al
mov byte [esi + 0x1f], al
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x30], eax
mov edx, dword [ebp + 0x18]
mov byte [ebp - 4], cl
mov ecx, dword [ebp + 0x14]
push 0x30061525
push eax
mov dword [esi + 0x38], ecx
push 4
lea ecx, [esi + 0x3c]
mov dword [esi + 0x34], edx
call fcn.3014bfc1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x3007d83e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3018712b
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x30024a78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.30064a68
mov ebx, eax
xor esi, esi
shl ebx, 4
push esi
mov ecx, edi
mov dword [ebp - 0x10], ebx
call fcn.30078752
mov eax, dword [edi + 0x34]
mov byte [eax + 0x15], 1
jmp 0x3007d88d
mov ebx, dword [ebp - 0x10]
xor esi, esi
call fcn.30064a68
mov ecx, dword [edi + 0x34]
mov ecx, dword [ecx + 0xc]
shl eax, 4
sub eax, ebx
cmp eax, ecx
mov ebx, eax
jl 0x3007d8a5
mov ebx, ecx
lea ecx, [ebp - 0x1c]
call fcn.3014b480
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.30078667
test al, al
je 0x3007d926
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.300649cb
lea ecx, [ebp - 0x40]
call fcn.300649e2
cmp eax, esi
je 0x3007d901
lea ecx, [ecx]
push eax
lea edx, [ebp - 0x2c]
push edx
mov eax, edx
push eax
call dword [sym.imp.USER32.dll_UnionRect]
lea ecx, [ebp - 0x40]
call fcn.300649e2
cmp eax, esi
jne 0x3007d8e7
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
push eax
push esi
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, edi
call fcn.3007d240
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
mov ecx, esi
call eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.30064473
mov esi, eax
test esi, esi
je 0x3007d957
lea ecx, [ebp - 0x1c]
call fcn.3006496a
push esi
call fcn.301471a2
lea ecx, [ebp - 0x1c]
call fcn.30064473
mov esi, eax
test esi, esi
jne 0x3007d93b
lea ecx, [ebp - 0x1c]
call fcn.30064774
mov ecx, dword [edi + 0x34]
cmp ebx, dword [ecx + 0xc]
jl 0x3007d888
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3007d97f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3018715c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x30024a78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
mov dword [esi], 0x300059f4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov edx, dword [0x301b6fd0]
mov dword [esi + 0x14], edx
mov eax, dword [0x301b6fd4]
mov dword [esi + 0x18], eax
mov ecx, dword [0x301b6fd8]
mov dword [esi + 0x1c], ecx
mov edx, dword [0x301b6fdc]
mov dword [esi + 0x20], edx
mov eax, dword [0x301b6fd0]
mov dword [esi + 0x24], eax
mov ecx, dword [0x301b6fd4]
mov dword [esi + 0x28], ecx
mov edx, dword [0x301b6fd8]
mov dword [esi + 0x2c], edx
mov eax, dword [0x301b6fdc]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov ecx, dword [ebp + 0x2c]
mov dl, byte [ebp + 0x18]
mov eax, dword [ebp + 0x24]
cmp eax, ebx
mov edi, dword [ebp + 0x28]
mov dword [esi + 0x38], ecx
mov ecx, dword [ebp + 0x20]
mov byte [esi + 0x50], dl
mov dl, byte [ebp + 0x30]
mov dword [ebp - 4], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edi
mov byte [esi + 0x51], bl
mov byte [esi + 0x52], dl
je 0x3007da4b
cmp edi, ebx
je 0x3007da4b
mov eax, 1
jmp 0x3007da4d
xor eax, eax
mov byte [esi + 0x53], al
mov byte [esi + 0x54], bl
mov byte [esi + 0x55], bl
mov byte [esi + 0x56], 1
mov byte [esi + 0x57], 1
mov dword [esi + 0x58], 1
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
cmp byte [esi + 0x53], bl
mov byte [ebp - 4], 1
je 0x3007da83
cmp byte [0x301b70f8], bl
je 0x3007da83
mov eax, 1
jmp 0x3007da85
xor eax, eax
cmp al, bl
mov byte [esi + 0x53], al
je 0x3007daa2
cmp byte [esi + 0x52], bl
je 0x3007da9e
cmp ecx, ebx
je 0x3007daa2
call fcn.3005b61f
cmp al, bl
jne 0x3007daa2
xor eax, eax
jmp 0x3007daa7
mov eax, 1
cmp al, bl
mov byte [esi + 0x54], al
jne 0x3007dada
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 4]
sub eax, 1
cmp eax, ebx
jle 0x3007dada
mov ecx, dword [ecx]
lea edi, [ecx + eax*4]
mov edx, dword [edi]
shr edx, 0x18
cmp dl, 0xfe
je 0x3007dad6
sub eax, 1
sub edi, 4
cmp eax, ebx
jg 0x3007dac0
jmp 0x3007dada
mov byte [esi + 0x55], 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push eax
push ecx
push edx
mov ecx, esi
call fcn.3007cd0e
cmp byte [esi + 0x55], bl
je 0x3007dafc
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x40], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x300800f0
Capabilities:
Get memory capacity

Disassembly:
push 0x3c
mov eax, 0x30187494
call fcn.3010f6cc
mov esi, dword [ebp + 8]
lea eax, [esi + 0x110]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.300649cb
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.300649e2
push eax
lea ecx, [ebp + 8]
call fcn.3006de4b
cmp dword [eax], ebx
je 0x30080150
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
cmp eax, dword [ebp + 0x10]
jne 0x3008011a
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.3008d8a9
xor eax, eax
inc eax
jmp 0x30080214
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x3008013d
push eax
lea ecx, [ebp + 8]
call fcn.3006de4b
push dword [ebp + 8]
lea ecx, [esi + 0x110]
call fcn.300bd6cd
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
cmp byte [esi + 0xf5], bl
mov dword [ebp + 0x14], eax
jne 0x3008013d
cmp eax, 3
jle 0x3008013d
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x40]
cmp eax, 0xffffffff
je 0x3008013d
shr eax, 0x14
mov dword [ebp + 0x10], eax
fild dword [ebp + 0x10]
lea eax, [esi + 0xb8]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 4]
fmul qword [0x300063f8]
mov edx, dword [eax + 8]
sub edx, dword [eax]
fstp dword [ebp + 0x10]
imul ecx, edx
fld dword [ebp + 0x10]
fadd qword [0x30001618]
fmul dword [ebp + 0x10]
fadd st(0), st(0)
shl ecx, 2
mov dword [ebp + 0x10], ecx
fstp dword [ebp - 0x14]
fild dword [ebp + 0x10]
fmul qword [0x300063f0]
fstp dword [ebp + 0x10]
fild dword [ebp + 0x14]
fmul dword [ebp + 0x10]
fstp dword [ebp + 0x10]
fld dword [ebp + 0x10]
fld dword [ebp - 0x14]
fcompp
fnstsw ax
test ah, 5
jp 0x3008013d
mov byte [esi + 0xf5], 1
jmp 0x3008013d
call fcn.3010f771
ret 0x10
Function at 0x300863db
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3018808c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x30024a78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
fldz
mov eax, dword [ebp + 8]
fst qword [esi + 0x18]
xor ecx, ecx
fld1
mov dword [esi], eax
fst qword [esi + 0x20]
mov dword [esi + 4], ecx
fstp qword [esi + 0x30]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
fst qword [esi + 0x28]
mov byte [esi + 0x48], 1
fst qword [esi + 0x38]
mov dword [esi + 0x4c], ecx
fstp qword [esi + 0x40]
cmp dword [eax + 0x20], ecx
jne 0x30086440
mov dword [eax + 0x20], esi
mov edi, dword [ebp + 0xc]
cmp edi, ecx
jne 0x30086454
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
cmp edi, ecx
je 0x3008652c
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
fld qword [edi + 0x20]
mov dword [edi + 4], esi
fstp qword [esi + 0x18]
fld qword [edi + 0x30]
fstp qword [esi + 0x28]
fld qword [edi + 0x40]
fstp qword [esi + 0x38]
mov ebx, dword [edi + 0x10]
cmp ebx, ecx
je 0x3008652c
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
mov ecx, ebx
call edx
test al, al
je 0x3008652c
mov eax, dword [0x30025c28]
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
push ecx
push 0x200
push 0
push 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.300856e7
mov eax, dword [ebp + 8]
cmp word [eax], 0
mov byte [ebp - 4], 2
je 0x300864c5
add eax, 0xfffffff8
push eax
call fcn.301471a2
fldz
mov edx, dword [ebx]
mov edx, dword [edx + 4]
push 0
sub esp, 8
lea eax, [ebp - 0x24]
fstp qword [esp]
push eax
mov ecx, ebx
call edx
test al, al
je 0x3008650c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x300864eb
mov eax, dword [eax]
jmp 0x300864ed
xor eax, eax
push 8
mov dword [ebp + 0xc], eax
call fcn.30147180
mov dword [ebp + 8], eax
lea ecx, [ebp + 0xc]
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.30085afe
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
mov ebx, eax
je 0x3008652c
mov eax, dword [eax]
cmp word [eax], 0
je 0x30086526
add eax, 0xfffffff8
push eax
call fcn.301471a2
push ebx
call fcn.301471a2
mov eax, dword [esi]
cmp edi, dword [eax + 0x24]
jne 0x30086536
mov dword [eax + 0x24], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x3008bd64
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp byte [esi + 0x166], 0
jne 0x3008bd7d
xor al, al
jmp 0x3008bf0a
mov eax, dword [esi + 0x168]
push edi
xor edi, edi
cmp eax, edi
jne 0x3008be0f
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.30064a68
mov edi, eax
lea eax, [ebp - 8]
push eax
shl edi, 4
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esi + 0x148]
mov ecx, edi
sub ecx, dword [eax]
cmp ecx, 0x1388
jbe 0x3008bdd3
mov dword [eax], edi
mov eax, dword [ebp - 8]
mov dword [esi + 0x140], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x144], eax
jmp 0x3008bef3
mov eax, dword [ebp - 8]
sub eax, dword [esi + 0x140]
jns 0x3008bde0
neg eax
cmp eax, dword [esi + 0x124]
jg 0x3008be01
mov eax, dword [ebp - 4]
sub eax, dword [esi + 0x144]
jns 0x3008bdf5
neg eax
cmp eax, dword [esi + 0x128]
jle 0x3008bef3
push 3
mov ecx, esi
call fcn.3008afa3
jmp 0x3008bef3
cmp eax, 3
jne 0x3008bef3
call fcn.3008b77c
test al, al
jne 0x3008bef3
push ebx
push 6
call fcn.3005e40b
mov ebx, eax
call dword [sym.imp.USER32.dll_GetCursor]
cmp eax, ebx
je 0x3008bef2
cmp byte [esi + 0x166], 0
je 0x3008bef2
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.30064a68
mov edi, eax
lea eax, [ebp - 8]
push eax
shl edi, 4
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, esi
call dword [eax + 0xa8]
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.3008bb19
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.30063427
test al, al
mov ebx, dword [ebp - 4]
je 0x3008bedd
mov ecx, dword [esi + 0x178]
test ecx, ecx
je 0x3008beb1
lea eax, [ebp - 0x10]
push eax
call fcn.3008b111
test al, al
jne 0x3008bedd
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x140]
jne 0x3008bedd
cmp ebx, dword [esi + 0x144]
jne 0x3008bedd
sub edi, dword [esi + 0x148]
cmp edi, 0xbb8
jbe 0x3008bef2
push 0
mov ecx, esi
call fcn.3008afa3
jmp 0x3008bef2
mov eax, dword [ebp - 8]
mov dword [esi + 0x148], edi
mov dword [esi + 0x140], eax
mov dword [esi + 0x144], ebx
pop ebx
mov esi, dword [esi + 0x168]
test esi, esi
pop edi
je 0x3008bf08
cmp esi, 2
je 0x3008bf08
xor eax, eax
inc eax
jmp 0x3008bf0a
xor eax, eax
pop esi
leave
ret
Function at 0x3008fb62
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0x70
mov eax, 0x30188d65
call fcn.3010f699
mov esi, ecx
mov eax, dword [esi + 0x14]
xor edi, edi
push edi
push edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.3008d8bd
mov eax, dword [esi + 0xc]
push edi
push edi
push eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], edi
call fcn.3008d8bd
push edi
push edi
push dword [esi + 0x10]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.3008d8bd
cmp dword [ebp - 0x48], edi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], edi
jbe 0x3008fc28
cmp dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], edi
jbe 0x3008fc08
mov dword [ebp - 0x10], edx
sub dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], esi
mov ecx, esi
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + ecx]
imul eax, edx
cdq
mov ebx, 0xff
idiv ebx
inc dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x18]
inc ecx
cmp eax, dword [ebp - 0x4c]
jb 0x3008fbe1
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
add eax, dword [ebp - 0x20]
add edx, dword [ebp - 0x28]
add esi, dword [ebp - 0x30]
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
jb 0x3008fbcb
lea ecx, [ebp - 0x64]
call fcn.3008d6f8
lea ecx, [ebp - 0x7c]
call fcn.3008d6f8
lea ecx, [ebp - 0x4c]
call fcn.3008d6f8
call fcn.3010f771
ret

Function at 0x300f4f22
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x301932ff
call fcn.3010f699
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x300f4f3c
xor eax, eax
jmp 0x300f4fce
mov dword [ebp - 0x10], esi
push 0x300024fc
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.30148a97
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.300f4e1d
test al, al
jne 0x300f4f89
mov eax, dword [ebp - 0x14]
cmp word [eax], si
je 0x300f4f79
add eax, 0xfffffff8
push eax
call fcn.301471a2
cmp dword [ebp - 0x10], esi
je 0x300f4f35
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x300f4f35
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [ebp - 0x14]
jne 0x300f4f6b
cmp word [eax], si
je 0x300f4fbd
add eax, 0xfffffff8
push eax
call fcn.301471a2
cmp dword [ebp - 0x10], esi
je 0x300f4fcb
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
call fcn.3010f771
ret 8
Function at 0x300f4fd6
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x3019332a
call fcn.3010f699
cmp dword [ebp + 8], 0x30002678
je 0x300f4ff2
xor eax, eax
jmp 0x300f507d
xor esi, esi
mov dword [ebp - 0x10], esi
push 0x300024fc
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.30148a97
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.300f4e1d
test al, al
jne 0x300f5042
mov eax, dword [ebp - 0x14]
cmp word [eax], si
je 0x300f5032
add eax, 0xfffffff8
push eax
call fcn.301471a2
cmp dword [ebp - 0x10], esi
je 0x300f4feb
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x300f4feb
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov eax, dword [ebp - 0x14]
jne 0x300f5024
cmp word [eax], si
je 0x300f506c
add eax, 0xfffffff8
push eax
call fcn.301471a2
cmp dword [ebp - 0x10], esi
je 0x300f507a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
call fcn.3010f771
ret 8

Function at 0x300f6328
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x40
mov eax, 0x3019367a
call fcn.3010f699
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x6e], bl
je 0x300f640a
cmp byte [esi + 0x102], bl
jne 0x300f640a
mov eax, dword [esi + 0x58]
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0xc4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x94]
push eax
lea ecx, [ebp - 0x30]
call fcn.300649cb
jmp 0x300f63e8
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x7c], bl
jne 0x300f63f6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x1d4c
ja 0x300f6412
push ebx
mov eax, 0x100
push eax
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x300f63b1
cmp dword [ebp - 0x44], 0x1b
je 0x300f641b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x94]
cmp eax, dword [ebp + 8]
jg 0x300f63f6
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x7c]
test al, al
jne 0x300f63e8
lea ecx, [ebp - 0x1c]
call fcn.300f5629
mov eax, dword [edi]
push ebx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [eax + 0x88]
lea ecx, [ebp - 0x30]
call fcn.300649e2
mov edi, eax
cmp edi, ebx
jne 0x300f637c
lea ecx, [ebp - 0x1c]
call fcn.300f5657
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.300f5657
call fcn.3010f771
ret 0x10
mov byte [esi + 0x102], 1
jmp 0x300f63f6
call fcn.30065aa0
int3
Function at 0x300ff0c1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
sar eax, 4
and esi, 0xf
inc eax
push 0
movzx eax, ax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
jne 0x300ff0e7
xor eax, eax
jmp 0x300ff131
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x300ff0e3
test esi, esi
jle 0x300ff10a
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x300ff100
mov ecx, dword [ebp + 0xc]
push edi
movzx edi, word [eax]
dec ecx
cmp ecx, edi
jge 0x300ff118
mov edi, ecx
lea esi, [edi + edi]
push esi
add eax, 2
push eax
push ebx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
and word [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x300ff2da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x301941f9
call fcn.3010f699
xor esi, esi
mov eax, dword [esi + 0x301b53cc]
mov ecx, dword [ebp + 8]
push 1
push eax
call fcn.30148566
test al, al
jne 0x300ff367
add esi, 4
cmp esi, 0x24
jb 0x300ff2e8
xor esi, esi
push dword [esi + 0x301b53cc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push eax
call fcn.30149cbd
push dword [ebp - 0x10]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x300ff34a
or dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
je 0x300ff340
add eax, 0xfffffff8
push eax
call fcn.301471a2
add esi, 4
cmp esi, 0x24
jb 0x300ff307
jmp 0x300ff367
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
call fcn.30148fce
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
je 0x300ff367
add eax, 0xfffffff8
push eax
call fcn.301471a2
call fcn.3010f771
ret 4

Function at 0x300ff844
Capabilities:
Get graphical window text

Disassembly:
push 0x10
mov eax, 0x3019428a
call fcn.3010f699
push dword [ebp + 8]
push 8
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ed
push ebx
call esi
mov edi, eax
mov eax, dword [0x30025c28]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x15
push dword [0x301b6ee0]
lea ecx, [ebp - 0x10]
call fcn.3014956f
push dword [ebp - 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
call edi
push 0x3ee
push ebx
call esi
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.301487a4
push esi
push dword [eax]
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x1c]
call fcn.301490df
push 0
push 0x3001412c
push 0x3000334c
lea ecx, [ebp - 0x10]
call fcn.3014944b
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call edi
push 0xffdb
push ebx
call fcn.3005afbb
test eax, eax
je 0x300ff901
mov eax, dword [ebp + 8]
push ebx
call fcn.300ff72c
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
je 0x300ff913
add eax, 0xfffffff8
push eax
call fcn.301471a2
xor eax, eax
call fcn.3010f771
ret 4
Function at 0x300ffd85
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x300ffd94
xor eax, eax
jmp 0x300ffdb3
push 0
push 0
push esi
push 0x300ffd0f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi], eax
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x300ffdb8
Capabilities:
Create process on windows

Disassembly:
push 0xc
mov eax, 0x301942bd
call fcn.3010f699
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, esi
jle 0x300fff27
cmp eax, 2
jle 0x300fff1d
cmp eax, 0x3f1
je 0x300ffdf9
cmp eax, 0x3f2
jne 0x300fff27
push dword [ebp + 8]
call fcn.300ffa95
jmp 0x300fff27
mov eax, dword [0x30025c28]
mov dword [ebp + 0xc], eax
push 0x105
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], esi
call fcn.301487a4
mov eax, dword [eax]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.301490df
cmp edi, esi
je 0x300ffe49
push 0x5c
lea ecx, [ebp + 0xc]
call fcn.301490b9
push 0x30002978
lea ecx, [ebp + 0xc]
call fcn.301495e7
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 8]
call fcn.30148ab7
push 0x17
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.30149d96
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push esi
push esi
push dword [ebp + 8]
mov ebx, 0x300063cc
push ebx
push esi
call edi
cmp eax, 0x20
ja 0x300ffef9
mov eax, dword [0x30025c28]
mov dword [ebp - 0x10], eax
movzx eax, word [0x301b6cf8]
push esi
push esi
push esi
push esi
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.3014971d
push 0x30002978
lea ecx, [ebp - 0x10]
call fcn.301495e7
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.30148fce
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.3014962a
push 0x17
lea ecx, [ebp + 8]
call fcn.30149d96
push 5
push esi
push esi
push dword [ebp + 8]
push ebx
push esi
call edi
cmp eax, 0x20
ja 0x300ffee8
push esi
push dword [ebp + 8]
push 0x3b
push esi
call fcn.300e6de2
mov eax, dword [ebp - 0x10]
cmp word [eax], si
je 0x300ffef9
add eax, 0xfffffff8
push eax
call fcn.301471a2
mov eax, dword [ebp + 8]
cmp word [eax], si
je 0x300fff0a
add eax, 0xfffffff8
push eax
call fcn.301471a2
mov eax, dword [ebp + 0xc]
cmp word [eax], si
je 0x300fff27
add eax, 0xfffffff8
push eax
call fcn.301471a2
jmp 0x300fff27
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc eax
call fcn.3010f771
ret 8