joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a981
Capabilities:
Print debug messages

Disassembly:
push 0x28
push 0x1002acf0
call fcn.100014a0
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
cmp dword [0x1003b754], ebx
je 0x1002a9af
push 0x1003b73c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], ebx
mov word [0x1003d3b0], bx
mov eax, dword [ebp + 0x14]
mov edi, 0x1003d3b0
cmp eax, ebx
je 0x1002a9eb
lea ecx, [ebp + 0x18]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], eax
push ecx
push eax
push 0xffd
push edi
call fcn.100276a2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov word [0x1003f3aa], bx
mov dword [ebp - 0x28], ebx
cmp word [0x1003d3b0], bx
je 0x1002aa0a
push 0x1002ab20
push 0x1000
push edi
call fcn.1002790f
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, 0x1000
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.100295fd
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], ebx
je 0x1002aa38
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.100297a6
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [esi]
call fcn.1002987d
cmp dword [esi], ebx
jne 0x1002aa4d
cmp dword [esi + 0x18], ebx
je 0x1002aa5d
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1002993f
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.10029bc2
push edi
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 8]
xor eax, eax
mov ax, word [esi + 4]
push eax
call fcn.10029d6b
mov ecx, dword [esi + 8]
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
jne 0x1002aa92
mov dword [ebp - 0x24], 1
or dword [ebp - 4], 0xffffffff
call fcn.1002ad10
cmp dword [esi + 0x18], ebx
je 0x1002ab19
cmp dword [esi + 0x1c], ebx
je 0x1002ab02
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1002aab8
call fcn.1002c875
test eax, eax
je 0x1002ab02
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1002ac48
push 0x3ff
push 0x1003cbb0
call fcn.100278e1
add esp, 0x20
push 0x1002abb8
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call ebx
push 0x1003cbb0
call ebx
push 0x1002ab28
call ebx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
je 0x1002ab19
push dword [esi + 0x1c]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1002a50a
call fcn.10001766
ret
Function at 0x1002ba17
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], ebx
jbe 0x1002ba6e
cmp dword [ebp - 4], 2
jbe 0x1002ba78
cmp dword [ebp - 4], 7
jne 0x1002ba6e
mov ecx, dword [edi]
test cl, 1
jne 0x1002ba6e
shr ecx, 1
cmp ecx, 2
jb 0x1002ba6e
cmp esi, ebx
je 0x1002ba71
cmp word [esi + ecx*2 - 2], bx
jne 0x1002ba6e
cmp word [esi + ecx*2 - 4], bx
je 0x1002ba71
push 0xd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov ecx, dword [edi]
test cl, 1
jne 0x1002ba6e
cmp esi, ebx
je 0x1002ba71
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
jmp 0x1002ba6c

Function at 0x1002c1b2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x1003b164]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push ebx
push edi
mov dword [ebp - 0xf8], 0xf0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002c231
cmp dword [ebp - 0xf8], 2
jb 0x1002c21d
mov eax, dword [ebp - 0xf4]
and eax, 0xffdf
cmp eax, 0x4e
je 0x1002c22c
cmp eax, 0x59
jne 0x1002c21d
mov dword [esi], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.10023cf0
leave
ret 0xc
and dword [esi], 0
jmp 0x1002c21d
mov eax, dword [esi]
neg eax
sbb eax, eax
and word [ebp - 0xf2], 0
and eax, 0xb
add eax, 0x4e
push 4
mov word [ebp - 0xf4], ax
lea eax, [ebp - 0xf4]
push eax
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1002c21d
Function at 0x1002d2c3
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1003b164]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
push eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
call esi
push ebx
mov dword [ebp - 0x238], eax
call esi
mov ecx, dword [ebp - 0x238]
lea eax, [ecx + eax + 2]
cmp eax, 0x111
jbe 0x1002d40e
push 0x72
push 0x1002d3a0
push 0x1002d338
call fcn.100280bc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.10023cf0
leave
ret 4
push ebx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100026fc
lea eax, [ebp - 0x228]
push eax
call esi
push dword [ebp - 0x234]
lea eax, [ebp - 0x228]
push eax
call esi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
lea eax, [ebp - 0x230]
push eax
push edi
lea eax, [ebp - 0x228]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1002d477
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002d327
xor eax, eax
inc eax
jmp 0x1002d329
Function at 0x1002fe87
Capabilities:
Impersonate user

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_LogonUserW]
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 3
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebp + 0xc]
call ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 8], esi
jne 0x1002ff7d
cmp eax, 0x569
je 0x1002fed3
cmp eax, 0x544
jne 0x1002ff8b
cmp dword [ebp + 8], esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x1002fee6
push dword [ebp + 8]
call edi
mov esi, eax
inc esi
push dword [ebp + 0xc]
call edi
lea eax, [esi + eax + 1]
add eax, eax
push eax
call fcn.1000bb9c
mov edi, eax
test edi, edi
pop ecx
je 0x1002ff3c
cmp dword [ebp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x1002ff45
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x100026fc
push edi
call esi
push dword [ebp + 0xc]
push edi
call esi
mov esi, 0x100054c4
push esi
push edi
call fcn.100300cd
test eax, eax
mov dword [ebp - 0xc], eax
jge 0x1002ff4b
push edi
call fcn.1000bbb1
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
and word [edi], 0
jmp 0x1002ff1c
lea eax, [ebp - 4]
push eax
push 0
push 4
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call ebx
cmp dword [ebp - 0xc], 0
mov dword [ebp - 8], eax
jne 0x1002ff6e
push esi
push edi
call fcn.10030289
push edi
call fcn.1000bbb1
cmp dword [ebp - 8], 0
pop ecx
je 0x1002ff8b
xor esi, esi
cmp dword [ebp - 4], esi
je 0x1002ff8b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x1002ff3e
Function at 0x1002ff95
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x1003b164]
and dword [ebp - 0xb0], 0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], 0x50
jne 0x1002ffe1
mov esi, 0x8000ffff
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.10023cf0
leave
ret 4
push 2
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
push eax
mov dword [ebp - 0xa8], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x10030010
mov esi, 0x8007000e
test ebx, ebx
je 0x1002ffd0
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x1002ffd0
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
push eax
push ebx
push edi
push 0
call esi
test eax, eax
je 0x10030048
mov eax, dword [ebp - 0xb4]
mov dword [eax], ebx
xor eax, eax
jmp 0x1002ffd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10030073
cmp dword [ebp - 0xac], 0x50
ja 0x100300a3
push dword [ebp - 0xa8]
push ebx
call dword [sym.imp.msvcrt.dll_realloc]
test eax, eax
pop ecx
pop ecx
je 0x1002fffd
mov ebx, eax
jmp 0x10030016
cmp dword [ebp - 0xb0], 0
jne 0x100300ad
push 0x5c
push edi
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0xb0], 1
je 0x100300ad
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
jmp 0x10030016
mov esi, 0x80070057
jmp 0x10030002
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100300c1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x10030002
Function at 0x100300cd
Capabilities:
Get domain controller name
Manipulate user privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
mov esi, 0x811
push esi
lea eax, [ebp - 0x40]
push eax
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp eax, ebx
je 0x1003011a
or eax, 0x10000000
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.1002ff95
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x10030262
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
push edi
call ebx
shl eax, 1
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x20]
add eax, 2
pop ecx
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
jne 0x100301a4
xor edi, edi
cmp dword [ebp - 0x14], edi
jbe 0x100301a4
movzx ecx, word [ebp - 0x20]
mov eax, dword [ebp - 0xc]
shr ecx, 1
push ecx
push dword [ebp - 0x1c]
lea eax, [eax + edi*8]
movzx ecx, word [eax]
shr ecx, 1
push ecx
push dword [eax + 4]
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10030272
inc edi
cmp edi, dword [ebp - 0x14]
jb 0x1003016f
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaAddAccountRights
xor ecx, ecx
cmp eax, ecx
je 0x10030230
cmp eax, 0xc0000187
jne 0x10030228
cmp dword [ebp - 0x18], ecx
jne 0x10030228
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
mov dword [ebp - 0x18], edi
call sub.NETAPI32.dll_NetGetDCName
test eax, eax
jne 0x1003027b
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov dword [ebp - 0x24], eax
call ebx
shl eax, 1
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x28]
pop ecx
push dword [ebp - 4]
add eax, 2
mov word [ebp - 0x26], ax
call sub.ADVAPI32.dll_LsaClose
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x10030151
or eax, 0x10000000
mov dword [ebp + 8], eax
cmp dword [ebp - 0xc], 0
je 0x1003023e
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_LsaFreeMemory
cmp dword [ebp - 0x10], 0
je 0x1003024c
push dword [ebp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 8], 0
je 0x1003025c
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 4], 0
je 0x1003026a
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [ebp + 8]
jmp 0x10030113
mov dword [ebp + 8], 1
jmp 0x10030230
mov dword [ebp + 8], 0x8000ffff
jmp 0x10030230
Function at 0x10030289
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
mov ebx, 0x811
push ebx
xor esi, esi
lea eax, [ebp - 0x34]
push eax
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp eax, esi
je 0x100302cd
or eax, 0x10000000
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.1002ff95
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x10030358
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push edi
call esi
shl eax, 1
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x14]
pop ecx
add eax, 2
push 1
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], edi
xor edi, edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaRemoveAccountRights
cmp eax, 0xc0000187
jne 0x100303c8
lea eax, [ebp - 0xc]
push eax
push edi
push edi
call sub.NETAPI32.dll_NetGetDCName
test eax, eax
je 0x10030368
mov dword [ebp + 8], 0x8000ffff
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x10030344
push dword [ebp - 0xc]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 8], esi
je 0x10030353
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 4], esi
je 0x10030360
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [ebp + 8]
jmp 0x100302c6
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
mov dword [ebp - 0x18], eax
call esi
shl eax, 1
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x1c]
pop ecx
push dword [ebp - 4]
add eax, 2
mov word [ebp - 0x1a], ax
call sub.ADVAPI32.dll_LsaClose
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x100303c8
push 1
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_LsaRemoveAccountRights
test eax, eax
je 0x10030335
or eax, 0x10000000
mov dword [ebp + 8], eax
jmp 0x10030335
Function at 0x10030a97
Capabilities:
Read file via mapping

Disassembly:
push 0x10
push 0x10030af0
call fcn.100014a0
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x20], edi
cmp dword [esi + 0x18], edi
jne 0x10030b16
push 0x10005518
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x10030ada
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x18], eax
cmp eax, edi
jne 0x10030b16
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10030b08
call esi
call fcn.10001766
ret
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x10030ae8
mov ecx, esi
call fcn.100307b5
test eax, eax
jne 0x10030b28
mov eax, 0x80070079
jmp 0x10030ae8
mov dword [ebp - 4], edi
xor edx, edx
inc edx
mov dword [ebp - 4], edx
mov eax, dword [esi + 0x18]
lea ecx, [eax + 0x10]
mov dword [esi + 0x1c], ecx
movzx ebx, word [eax]
imul ebx, ebx, 0x70
add ecx, ebx
mov dword [esi + 0x20], ecx
movzx eax, word [eax + 2]
imul eax, eax, 0x134
add eax, ecx
mov dword [esi + 0x24], eax
mov dword [esi + 8], edx
mov dword [ebp - 4], edi
or dword [ebp - 4], 0xffffffff
call fcn.10030b99
mov eax, dword [ebp - 0x20]
jmp 0x10030ae8
Function at 0x10030c54
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
push 0x10030e58
call fcn.100014a0
mov dword [ebp - 0x30], ecx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
push eax
push 0x20019
push ebx
push 0x10030e08
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x10030d6e
push 4
pop edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x10030de8
push dword [ebp - 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x10030cd6
cmp dword [ebp - 0x20], edi
jne 0x10030cd6
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffffe
jae 0x10030cd6
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x10030dc8
push dword [ebp - 0x28]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x10030d0a
cmp dword [ebp - 0x20], edi
jne 0x10030d0a
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffffe
jae 0x10030d0a
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x10030da0
push dword [ebp - 0x28]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x10030d3e
cmp dword [ebp - 0x20], edi
jne 0x10030d3e
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffffe
jae 0x10030d3e
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x10030d80
push dword [ebp - 0x28]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x10030d6e
cmp dword [ebp - 0x20], edi
jne 0x10030d6e
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x28], eax
or dword [ebp - 4], 0xffffffff
call fcn.10030e70
call fcn.10001766
ret 0xc
Function at 0x401b4d
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0xc]
push 0x401b1e
push eax
push eax
call sub.kernel32.dll_CreateThread
ret 4

Function at 0x401b64
Capabilities:
Create thread

Disassembly:
mov eax, 1
xchg byte [0x4040b6], al
or eax, eax
je 0x401b7b
push eax
call sub.kernel32.dll_Sleep
jmp fcn.00401b64
push eax
push eax
push dword [esp + 0xc]
push 0x401b90
push eax
push eax
call sub.kernel32.dll_CreateThread
ret 4

Function at 0x40246b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x404f28]
call sub.user32.dll_OpenClipboard
or eax, eax
je 0x40250a
xor esi, esi
call sub.user32.dll_EmptyClipboard
inc esi
or eax, eax
je 0x402502
call fcn.00402401
mov ebx, ecx
add eax, dword [ebp + 8]
mov edi, edx
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x402502
push eax
push eax
call sub.kernel32.dll_GlobalLock
mov ecx, ebx
mov edx, edi
cmp byte [ebp + 8], 0x11
pop ebx
mov edi, esi
je 0x4024cf
mov dword [eax], 0x646f635b
mov word [eax + 4], 0x5d65
dec edi
add eax, 6
call fcn.00402438
xor edx, edx
dec edi
je 0x4024e7
mov dword [eax - 2], 0x6f632f5b
mov edx, 0x5d6564
inc eax
inc eax
mov dword [eax], edx
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 7
call sub.user32.dll_SetClipboardData
or eax, eax
je 0x4024fc
dec esi
push ebx
call sub.kernel32.dll_GlobalFree
call sub.user32.dll_CloseClipboard
dec esi
jne 0x402521
push 0x10
push str.Error_Copying_to_Clipboard
push str.Close_any_programs_that_may_be_using_the_clipboard_and_try_again
push dword [0x404f28]
call sub.user32.dll_MessageBoxA
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402735
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
xchg byte [edx], cl
jecxz 0x402770
mov eax, dword [ebp + 0x10]
cmp eax, 0x25
je 0x40274e
cmp eax, 0x26
jne 0x402753
mov dword [0x404f70], eax
push 2
push eax
push dword [0x404f18]
call sub.user32.dll_EnableMenuItem
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
push eax
call sub.kernel32.dll_CreateThread
leave
ret 0xc
Function at 0x402814
Capabilities:
Write file on windows

Disassembly:
xor eax, eax
cmp eax, 0
je 0x40282b
xchg byte [0x4040ae], al
mov al, ah
cmp al, byte [0x4040af]
jne 0x402823
push dword [0x404f14]
call sub.gdi32.dll_DeleteObject
call fcn.004027ca
push eax
mov esi, ecx
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0x78
stosw word es:[edi], ax
mov eax, dword [0x405014]
sub eax, dword [0x40500c]
stosw word es:[edi], ax
mov eax, dword [0x405018]
sub eax, dword [0x405010]
stosw word es:[edi], ax
mov eax, dword [0x40415c]
mov ah, byte [0x40411c]
sub eax, 0x404
cmp dword [0x4041b0], 0
jne 0x402881
or eax, 0x20
mov ecx, dword [0x4042e8]
shl ecx, 3
or eax, ecx
mov ecx, dword [0x404348]
shl ecx, 4
or eax, ecx
mov ecx, dword [0x404354]
shl ecx, 0xa
or eax, ecx
mov ecx, dword [0x40436c]
shl ecx, 0xb
or eax, ecx
mov ecx, dword [0x404378]
shl ecx, 0xc
or eax, ecx
stosw word es:[edi], ax
mov eax, dword [0x404198]
stosd dword es:[edi], eax
dec edi
mov eax, dword [0x40419c]
stosd dword es:[edi], eax
push 0x20
dec edi
mov esi, 0x404f8c
pop ecx
movsd dword es:[edi], dword [esi]
dec edi
loop 0x4028d0
mov esi, 0x405068
mov edi, edx
or ecx, 0x1e
repe cmpsd dword [esi], dword es:[edi]
je 0x40290b
pop eax
mov edi, edx
push eax
push 0x40000002
push eax
call fcn.00402774
inc eax
je 0x40290b
dec eax
push eax
push eax
mov edx, esp
push 0
push edx
push 0x78
push edi
push eax
call sub.kernel32.dll_WriteFile
pop ecx
call sub.kernel32.dll_CloseHandle
call fcn.00402805
ret

Function at 0x402911
Capabilities:
Create thread
Terminate process

Disassembly:
call fcn.00402bf2
cmp edi, 0
je 0x402925
call fcn.0040318f
call fcn.0040213b
push edi
push dword [0x404f08]
push ebx
push edi
push dword [0x404190]
push dword [0x40418c]
push ebp
push 0x80000000
push 0x12cf0000
push dword [0x404010]
push esi
push edi
call sub.user32.dll_CreateWindowExA
push eax
call sub.user32.dll_UpdateWindow
call fcn.0040321e
pushal
cmp edi, dword [section..data]
mov byte [0x404607], 0xff
mov byte [0x404605], 7
mov ebp, esp
jne 0x402987
push edi
push edi
push edi
push 0x403150
push edi
push edi
call sub.kernel32.dll_CreateThread
jmp 0x4029a0
push edi
call fcn.00401b4d
call fcn.00401fea
jmp 0x4029a0
push ebp
call sub.user32.dll_TranslateMessage
push ebp
call sub.user32.dll_DispatchMessageA
push edi
push edi
push edi
push ebp
call sub.user32.dll_GetMessageA
inc eax
shr eax, 1
jne 0x402994
push dword [0x404f24]
call fcn.00402805
pop eax
jmp fcn.00403340
Function at 0x4030ad
Capabilities:
Create process on windows

Disassembly:
push edi
push ebx
xor edi, edi
push esi
cmp edi, dword [section..data]
mov ebx, 0xfa
jne 0x403118
push ebx
call sub.kernel32.dll_Sleep
push 0x10
push 0x4040c1
push dword [0x404f28]
call fcn.00401d75
pop ecx
xor eax, eax
sub esp, 0x50
mov edi, esp
rep stosd dword es:[edi], eax
push 0x44
xchg edi, eax
mov edx, esp
push 0x28
push eax
push edx
push edi
push edi
push 0x220
push edi
push edi
push edi
push str.dTest.exe
push edi
call sub.kernel32.dll_CreateProcessA
or eax, eax
pop esi
je 0x40311c
push ebx
call sub.kernel32.dll_Sleep
dec esi
je 0x40311c
cmp edi, dword [section..data]
je 0x403104
add esp, 0x54
pop esi
pop ebx
pop edi
ret
push 0x10
push dword [0x404010]
push str.Unable_to_Open_Presentation_Manager_Application
push dword [0x404f28]
call sub.user32.dll_MessageBoxA
push dword [0x404f14]
call sub.gdi32.dll_DeleteObject
push dword [0x404f24]
call fcn.00402805
push edi
call fcn.00403340
call fcn.0040315c
push 0
call sub.kernel32.dll_ExitThread

Function at 0x40321e
Capabilities:
Create thread

Disassembly:
mov ecx, 0
jecxz 0x40324c
push edi
mov edi, 0x404050
mov ecx, 0x51
jmp 0x403238
stosb byte es:[edi], al
inc eax
cmp al, 0x7a
jbe 0x40323a
mov al, 0x30
loop 0x403232
push ecx
push ecx
push ecx
push 0x40324d
push ecx
push ecx
call sub.kernel32.dll_CreateThread
pop edi
ret