joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3004c042
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0x3004c05a
xor eax, eax
jmp 0x3004c1d1
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
je 0x3004c072
push eax
call fcn.3005bb8a
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ebx
push edi
or edi, 0xffffffff
cmp dword [ebp - 8], ebx
jne 0x3004c08f
cmp dword [0x300d573c], ebx
je 0x3004c09d
mov dword [ebp - 0x1c], 2
jmp 0x3004c0aa
cmp dword [ebp - 8], 1
jne 0x3004c09d
cmp dword [0x300d673c], ebx
je 0x3004c0a7
test byte [esi + 0xc], 0x10
je 0x3004c16b
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x10], ebx
call fcn.3004ae58
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
jmp 0x3004c133
mov eax, dword [ebp - 0xc]
cmp eax, ebx
mov esi, dword [ebp - 0x10]
jne 0x3004c0d2
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
mov edi, eax
jae 0x3004c0fd
cmp dword [ebp - 0x14], 1
je 0x3004c0fa
cmp dword [ebp - 0x14], 2
jne 0x3004c0fd
push 2
pop edi
push edi
call fcn.3004aa76
test eax, eax
pop ecx
je 0x3004c146
push 0x796d746f
push ebx
call fcn.30043608
push esi
mov ecx, 0x300d5748
call fcn.3004aff6
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.3004b0b8
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x3004c0c6
jmp 0x3004c155
push esi
mov ecx, 0x300d5748
call fcn.3004af74
cmp edi, ebx
je 0x3004c17a
cmp dword [0x300d5744], ebx
je 0x3004c168
push 0x300d5260
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 8]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x3004c076
jmp 0x3004c18d
cmp dword [0x300d5744], ebx
je 0x3004c191
push 0x300d5260
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, ebx
jne 0x3004c1b1
cmp dword [ebp - 0x14], 2
je 0x3004c1a3
mov eax, dword [ebp + 8]
mov al, byte [eax + 0xc]
and al, 0xf
cmp al, 2
jne 0x3004c1b1
push dword [ebp - 4]
call fcn.3004ac97
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 0x18], ebx
je 0x3004c1be
push dword [ebp - 0x18]
call fcn.300432ec
cmp edi, ebx
pop edi
je 0x3004c1ce
push dword [ebp + 8]
call fcn.3004acb2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x3004cbb2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call fcn.300462c3
test eax, eax
jne 0x3004cbcf
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
push ebx
push esi
push edi
push eax
push 0x11
call fcn.30045e06
push dword [ebp - 0x1c]
push 0x12
call fcn.30045e06
push 0x3000a6b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x3004ccd1
push 0x3000a698
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x3004ccd1
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x3004ccd1
push dword [ebp - 4]
call fcn.30043102
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x3004ccc9
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
je 0x3004ccc9
mov eax, dword [ebp - 4]
push 0x18
xor edx, edx
pop ecx
div ecx
xor ebx, ebx
and dword [ebp - 8], ebx
xor esi, esi
test eax, eax
jbe 0x3004ccc9
mov edx, edi
mov edi, eax
mov eax, dword [edx + 4]
sub eax, 0
je 0x3004cc81
dec eax
dec eax
jne 0x3004cc92
push dword [edx]
call fcn.3004c4bf
cmp ebx, eax
pop ecx
ja 0x3004cc92
mov ebx, eax
jmp 0x3004cc92
push dword [edx]
inc dword [ebp - 8]
call fcn.3004c4bf
cmp esi, eax
pop ecx
ja 0x3004cc92
mov esi, eax
add edx, 0x18
dec edi
jne 0x3004cc65
test esi, esi
je 0x3004cca7
push esi
push 0x19e1
call fcn.30045e06
test ebx, ebx
je 0x3004ccb6
push ebx
push 0x19e2
call fcn.30045e06
cmp dword [ebp - 8], 0
je 0x3004ccc9
push dword [ebp - 8]
push 0x19e0
call fcn.30045e06
push dword [ebp - 0xc]
call fcn.3004315f
xor esi, esi
cmp dword [ebp - 0x1c], esi
ja 0x3004ccec
push esi
push 0x72766c74
call fcn.300435b4
cmp dword [ebp - 0x1c], esi
jbe 0x3004cd7f
push 0x3000a67c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
jne 0x3004cd05
push esi
push 0x3366646b
jmp 0x3004cd1d
push 0x3000a664
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x3004cd24
push eax
push 0x3366646c
call fcn.300435b4
jmp 0x3004cd74
mov eax, dword [ebp - 0x1c]
push 0x18
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call fcn.30043102
mov esi, eax
test esi, esi
je 0x3004cd74
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x18
push eax
push esi
push 0
push 0
push 0xb
call edi
test eax, eax
je 0x3004cd63
push 0
push 0x72766c76
call fcn.300435b4
jmp 0x3004cd6d
push dword [esi + 4]
push 0x10
call fcn.30045e06
push esi
call fcn.300257c4
pop ecx
test ebx, ebx
je 0x3004cd7f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3004cde7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], esi
xor ebx, ebx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov word [ebp - 0x20c], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x3004ce9c
push esi
push 0x33753467
call fcn.300435b4
mov edi, 0x3a98
push edi
push 0xfa1
call fcn.30045e06
push edi
push 0xfa2
call fcn.30045e06
push edi
push 0xfa3
call fcn.30045e06
push edi
push 0xfa4
call fcn.30045e06
cmp ebx, esi
je 0x3004ce8d
push ebx
call fcn.300257c4
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.30069776
leave
ret
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.30064d80
mov edi, eax
cmp edi, esi
je 0x3004ce51
push edi
call fcn.30043102
mov ebx, eax
cmp ebx, esi
jne 0x3004cec9
push esi
push 0x33753468
jmp 0x3004ce4c
push ebx
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.30064d86
test eax, eax
jne 0x3004cee7
push esi
push 0x33753469
jmp 0x3004ce4c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x30003970
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x3004cf0f
push esi
push 0x3375346a
jmp 0x3004ce4c
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xa]
push eax
push 0xfa1
call fcn.30045e06
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 8]
push eax
push 0xfa2
call fcn.30045e06
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xe]
push eax
push 0xfa3
call fcn.30045e06
mov eax, dword [ebp - 0x210]
movzx eax, word [eax + 0xc]
push eax
jmp 0x3004ce78

Function at 0x3004d258
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x3004d2f9
cmp dword [ebp - 0x90], 2
mov edx, dword [ebp - 0x98]
mov dword [0x300d5280], edx
jne 0x3004d2ed
mov eax, dword [ebp - 0x9c]
cmp eax, 5
mov cx, word [ebp - 0xc]
mov dword [0x300d527c], eax
mov word [0x300d5284], cx
jne 0x3004d2d7
xor eax, eax
inc eax
cmp edx, eax
jb 0x3004d2f9
test cx, cx
mov dword [0x300d5288], eax
ja 0x3004d2cb
cmp edx, eax
jbe 0x3004d2d0
mov dword [0x300d528c], eax
cmp cx, ax
jbe 0x3004d2f9
jmp 0x3004d2e6
jbe 0x3004d2f9
xor eax, eax
inc eax
mov dword [0x300d5288], eax
mov dword [0x300d528c], eax
mov dword [0x300d5290], eax
jmp 0x3004d2f9
push 0
push 0x77617376
call fcn.300435b4
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
xor ecx, ebp
mov dword [section..data], eax
call fcn.30069776
leave
ret
Function at 0x3004d4cc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x300d6748], 0
je 0x3004d4ef
mov eax, dword [0x300d6744]
jmp 0x3004d56e
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0xa0]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
je 0x3004d52b
test byte [ebp - 8], 0x10
je 0x3004d52b
xor eax, eax
inc eax
jmp 0x3004d55e
mov ecx, dword [0x300d527c]
xor eax, eax
cmp ecx, 5
mov dword [0x300d6744], eax
jg 0x3004d547
jne 0x3004d563
cmp dword [0x300d5280], eax
jbe 0x3004d563
lea eax, [ebp - 0xa0]
push eax
call esi
test eax, eax
je 0x3004d55c
test word [ebp - 8], 0x100
jne 0x3004d526
xor eax, eax
mov dword [0x300d6744], eax
mov dword [0x300d6748], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30069776
leave
ret

Function at 0x30059eb2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059f3d
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059ef0
cmp byte [eax], 0
je 0x30059f34
lea eax, [eax + 1]
test eax, 3
je 0x30059ef0
cmp byte [eax], 0
je 0x30059f34
lea eax, [eax + 1]
test eax, 3
je 0x30059ef0
cmp byte [eax], 0
je 0x30059f34
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x30059ef0
test cl, cl
lea eax, [eax - 4]
je 0x30059f34
test ecx, 0xff00
lea eax, [eax + 1]
je 0x30059f34
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x30059f34
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x30059f34
lea eax, [eax + 1]
jmp 0x30059ef0
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x30059f43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059fb5
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059f74
cmp word [eax], 0
je 0x30059f6d
lea eax, [eax + 2]
test eax, 3
je 0x30059f74
jmp 0x30059f5b
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30059faf
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x30059f74
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30059faf
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30059faf
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x30059f74
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x3005ebf9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3005ec13
test al, 0x10
je 0x3005ec13
xor eax, eax
inc eax
jmp 0x3005ec15
xor eax, eax
pop ebp
ret 4

Function at 0x30060470
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call dword [sym.imp.MSVCR80.dll__vsnprintf]
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30069776
leave
ret

Function at 0x30063bfd
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x300d7304
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x30063c4e
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [0x300d7308], eax
mov ax, word [ebp - 0x30]
mov word [0x300d730c], ax
mov eax, dword [ebp - 0x18]
mov dword [0x300d7310], eax
mov eax, dword [ebp - 0x40]
mov dword [0x300d7314], eax
mov eax, esi
pop esi
leave
ret

Function at 0x30066947
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x300d73d4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x30066970
mov edi, 0x8ff000ff
jmp 0x300669b5
test ebx, ebx
je 0x300669b0
call fcn.300661a6
mov edi, eax
test edi, edi
jl 0x300669b5
push esi
call fcn.3006511d
mov esi, eax
test esi, esi
je 0x300669b0
test byte [esi + 0x1f], 4
jne 0x300669a7
push esi
call fcn.30065d43
mov edi, eax
test edi, edi
jge 0x300669a7
cmp edi, 0x8007000e
je 0x300669b5
xor edi, edi
mov eax, dword [ebp + 0xc]
dec eax
je 0x300669c8
dec eax
je 0x300669e0
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.30069776
leave
ret 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x300669e0
cmp byte [esi + 0x1e], 0
jbe 0x300669e0
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x300669b5
cmp dword [esi + 8], 0x1000
jne 0x30066a07
call fcn.300692fb
test al, al
je 0x30066a07
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 4]
call fcn.3006929d
jmp 0x30066a1b
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x300669b0
lea eax, [ebp - 0xc]
push eax
call fcn.30065105
push ebx
push eax
call fcn.300660f2
mov edi, eax
jmp 0x300669b5
Function at 0x30066a33
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x300d73bc
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [esi + 0x1f], 2
jne 0x30066c48
mov eax, dword [esi + 0x14]
cmp eax, ebx
push edi
mov edi, 0x300d73f8
je 0x30066a89
push eax
mov ecx, edi
call fcn.300690fd
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x30066b8a
lea eax, [ebp - 0x23c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x300221fc
push ebx
call fcn.30067f89
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x30066b8a
mov eax, dword [ebp - 0x238]
push 4
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or eax, ecx
push eax
mov ecx, edi
call fcn.300690d3
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x30066b9a
cmp dword [ebp - 0x238], ebx
mov dword [ebp - 0x21c], ebx
jbe 0x30066b5e
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x23c]
push dword [eax + ecx*4]
call fcn.3006642f
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x30066b43
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x224]
mov dword [ecx + eax*4], edx
inc byte [esi + 0x1d]
jmp 0x30066b4a
cmp eax, 0x8007000e
je 0x30066b75
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x238]
jb 0x30066b09
cmp byte [esi + 0x1d], bl
jne 0x30066c34
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
jmp 0x30066c34
push dword [esi + 0x14]
mov ecx, edi
call fcn.300690fd
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
jmp 0x30066c47
push 4
mov ecx, edi
call fcn.300690d3
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x30066ba9
mov dword [ebp - 0x218], 0x8007000e
jmp 0x30066c47
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
call fcn.300692fb
test al, al
je 0x30066bd9
cmp dword [esi + 8], 0x1000
jne 0x30066bd9
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 4]
call fcn.3006929d
jmp 0x30066bf0
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x30066c34
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], ebx
call fcn.30065183
test eax, eax
je 0x30066c28
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.300683ea
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x30066c47
cmp dword [esi + 8], 0xc00
je 0x30066c41
or byte [esi + 0x1f], 2
mov dword [ebp - 0x218], ebx
pop edi
push 0x300d73bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], ebx
pop esi
pop ebx
je 0x30066c69
lea eax, [ebp - 0x23c]
push eax
call fcn.30067ff6
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.30069776
leave
ret 4
Function at 0x300692fb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x300d7407], 0
jne 0x30069355
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x3006934e
cmp dword [ebp - 0x110], 2
jne 0x3006934e
cmp dword [ebp - 0x11c], 6
jb 0x3006934e
call fcn.300691b0
mov byte [0x300d7406], al
mov byte [0x300d7407], 1
mov ecx, dword [ebp - 4]
mov al, byte [0x300d7406]
xor ecx, ebp
call fcn.30069776
leave
ret

Function at 0x300696c2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x300222d0
push 0x3000a6b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x300696f7
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x300222cc
push ebx
call edi
test esi, esi
mov dword [0x300222cc], esi
jne 0x3006975b
mov dword [0x300222cc], 0xbb40e64e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x300bcb40], 0x44bf19b1
pop ebx
leave
ret
Function at 0x30069776
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x300222cc]
jne 0x3006a49a
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x300d7570], eax
mov dword [0x300d756c], ecx
mov dword [0x300d7568], edx
mov dword [0x300d7564], ebx
mov dword [0x300d7560], esi
mov dword [0x300d755c], edi
mov word [0x300d7588], ss
mov word [0x300d757c], cs
mov word [0x300d7558], ds
mov word [0x300d7554], es
mov word [0x300d7550], fs
mov word [0x300d754c], gs
pushfd
pop dword [0x300d7580]
mov eax, dword [ebp]
mov dword [0x300d7574], eax
mov eax, dword [ebp + 4]
mov dword [0x300d7578], eax
lea eax, [ebp + 8]
mov dword [0x300d7584], eax
mov eax, dword [ebp - 0x320]
mov dword [0x300d74c0], 0x10001
mov eax, dword [0x300d7578]
mov dword [0x300d7474], eax
mov dword [0x300d7468], 0xc0000409
mov dword [0x300d746c], 1
mov eax, dword [0x300222cc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x300bcb40]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x300d74b8], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x300225a0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x300d74b8], 0
jne 0x3006a58a
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x3006978e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x30005bbc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x300697e6
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push 0x30005bb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x300697e6
mov al, 1
jmp 0x300697e8
xor al, al
leave
ret 8
Function at 0x3006a020
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x30088960
call fcn.3006a036
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300d88f8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30069dbf
cmp eax, esi
jne 0x30069db2
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30069dc2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30069d99
xor esi, esi
inc esi
mov eax, dword [0x300d88f4]
cmp eax, esi
jne 0x30069dd5
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30069e04
mov eax, dword [0x300d88f4]
test eax, eax
jne 0x30069dfe
mov dword [0x300d88f4], esi
push 0x3000169c
push 0x30001690
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30069e04
jmp 0x30069f2c
mov dword [0x300d7460], esi
mov eax, dword [0x300d88f4]
cmp eax, esi
jne 0x30069e28
push 0x3000168c
push 0x30001674
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300d88f4], 2
test ebx, ebx
jne 0x30069e34
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300d8904], 0
je 0x30069e58
push 0x300d8904
call fcn.3006a65d
pop ecx
test eax, eax
je 0x30069e58
push 0
push 2
push 0
call dword [0x300d8904]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30069eb4
test al, al
je 0x30069e72
cmp dword [ebp - 0x1c], 0
jne 0x30069eb4
mov al, byte [esi]
test al, al
je 0x30069e82
cmp al, 0x20
ja 0x30069e82
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30069e72
test byte [ebp - 0x3c], 1
je 0x30069e8e
movzx eax, word [ebp - 0x38]
jmp 0x30069e91
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x300d745c], eax
cmp dword [0x300d7450], 0
jne 0x30069f08
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30069ec3
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30069ed6
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30069e5f
cmp dword [0x300d7460], 0
jne 0x30069f17
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x300d745c]
jmp 0x30069f38
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.3006a07b
ret
call fcn.300696c2
jmp 0x30069d5f