joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3002ca7c
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 0x40e
lea eax, [ebp - 0x61a]
push esi
push eax
mov dword [ebp - 0x620], esi
mov word [ebp - 0x61c], si
call sub.MSVCR80.dll_memset
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call sub.MSVCR80.dll_memset
mov edi, dword [ebp + 8]
add esp, 0x18
cmp edi, esi
je 0x3002cbe8
call fcn.3002ca1a
test eax, eax
je 0x3002cb03
cmp dword [ebp + 0xc], esi
je 0x3002cb03
call fcn.3003db37
test eax, eax
je 0x3002cbf3
push 0x300034d0
call fcn.3003dbd1
jmp 0x3002cbf3
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x620]
push ecx
push esi
push 0x2001f
and eax, 0x10000000
push esi
neg eax
push esi
sbb eax, eax
push esi
neg eax
add eax, 0x80000001
push 0x30003294
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x3002cb4a
call fcn.3003db37
test eax, eax
je 0x3002cbf3
push 0x300034b0
jmp 0x3002caf9
cmp dword [ebp + 0xc], esi
jne 0x3002cb65
push 0x30003238
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x3002cbf3
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x3002cbf3
dec eax
cmp word [ebp + eax*2 - 0x20c], 0x5c
jne 0x3002cb78
push 0x74
mov word [ebp + eax*2 - 0x20c], si
push 0x30003494
lea eax, [ebp - 0x20c]
push eax
push 0x3000347c
lea eax, [ebp - 0x61c]
push 0x208
push eax
call dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call fcn.30059f43
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x61c]
push eax
push 1
push esi
push 0x30003238
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x3002cbf3
push esi
push 0x30303030
call fcn.300435b4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.30069776
leave
ret 8

Function at 0x3002e6b9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call fcn.3006a910
test eax, eax
je 0x3002e6d1
xor eax, eax
inc eax
jmp 0x3002e757
push esi
push edi
xor esi, esi
push esi
push esi
push 0x80
push 2
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.3005ec81
mov edi, eax
cmp edi, 0xffffffff
jne 0x3002e710
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.3003db37
test eax, eax
je 0x3002e74e
push dword [ebp - 4]
push 0x30003950
jmp 0x3002e747
push ebx
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
pop ebx
jne 0x3002e752
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.3003db37
test eax, eax
je 0x3002e74e
push dword [ebp - 4]
push 0x30003930
call fcn.3003dc56
pop ecx
pop ecx
xor eax, eax
jmp 0x3002e755
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc
Function at 0x3002e9d7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb04
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
lea ebx, [edi + 0x21c]
cmp dword [ebx], ecx
mov dword [ebp - 0xb00], ecx
jne 0x3002ea2e
push 5
push 5
push 0x44c
push ebx
call fcn.30059df1
test eax, eax
jne 0x3002ea4d
call fcn.3003db37
test eax, eax
je 0x3002ea27
push 0x300039e8
call fcn.3003dbd1
xor eax, eax
jmp 0x3002ebd1
mov eax, dword [ebx]
push dword [eax]
push ecx
push eax
call fcn.30059a2a
test eax, eax
jne 0x3002ea4d
call fcn.3003db37
test eax, eax
je 0x3002ea27
push 0x300039c0
jmp 0x3002ea22
push edi
call fcn.3002c7b5
test eax, eax
je 0x3002ea27
push esi
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20c]
lea eax, [edi + 0xc]
push ecx
push eax
call fcn.3005b404
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x300039b0
call fcn.3005b486
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xafc], eax
je 0x3002eba5
test dword [ebp - 0x8a8], 0xffffffef
je 0x3002eb6e
push 0x44c
lea eax, [ebp - 0x658]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x658]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.3005b404
push esi
lea eax, [ebp - 0x658]
push eax
push 0x30003970
call fcn.3005b486
push esi
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x87c]
push eax
call fcn.3005b486
push esi
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x658]
push eax
call fcn.3002d9b8
test eax, eax
jne 0x3002eb25
push eax
push 0x30303030
call fcn.300435b4
jmp 0x3002eb98
lea eax, [ebp - 0xaf8]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xb04], eax
je 0x3002eb62
test dword [ebp - 0xaf8], 0xffffffef
je 0x3002eb62
mov ecx, dword [ebx]
lea eax, [ebp - 0x658]
push eax
call fcn.30025d49
test eax, eax
je 0x3002ebe1
push dword [ebp - 0xb04]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x8a8]
push eax
push dword [ebp - 0xafc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x3002eb98
push dword [ebp - 0xafc]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0xafc], 0xffffffff
cmp dword [ebp - 0xafc], 0xffffffff
jne 0x3002eaa3
mov dword [ebp - 0xb00], 1
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0xb00], 0
pop esi
jne 0x3002ebcb
push edi
call fcn.3002e850
mov eax, dword [ebp - 0xb00]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.30069776
leave
ret 4
call fcn.3003db37
test eax, eax
je 0x3002ebaf
push 0x30003988
call fcn.3003dbd1
jmp 0x3002ebaf
Function at 0x3002ebf6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test dword [esi], 0x10000000
push edi
mov edi, 0x104
lea ebx, [esi + 0xc]
je 0x3002ec65
push edi
push ebx
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
mov dword [ebp - 8], eax
je 0x3002ec36
cmp eax, edi
jbe 0x3002ec92
call fcn.3003db37
test eax, eax
je 0x3002ec52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30003a80
call fcn.3003dc56
pop ecx
pop ecx
push 0
push 0x30303030
call fcn.300435b4
xor eax, eax
jmp 0x3002ede3
push 1
push 0x1c
push ebx
push 0
mov dword [ebp + 8], SysStringLen
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x3002ec92
call fcn.3003db37
test eax, eax
je 0x3002ec52
push 0x30003a58
call fcn.3003dbd1
jmp 0x3002ec52
push edi
push ebx
push 0x300226a4
call fcn.3005b486
lea ecx, [ebp - 8]
push ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push 0x300031d8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x3002ecda
call fcn.3003db37
test eax, eax
je 0x3002ecd6
push 0x30003a34
call fcn.3003dbd1
and dword [esi + 8], 0
mov eax, dword [esi]
and eax, 7
dec eax
je 0x3002ed9c
dec eax
je 0x3002ed58
dec eax
dec eax
je 0x3002ed11
call fcn.3003db37
test eax, eax
je 0x3002ec5e
mov eax, dword [esi]
and eax, 7
push eax
push 0x30003a0c
call fcn.3003dc56
pop ecx
pop ecx
jmp 0x3002ec5e
push edi
push ebx
push 0x300226f4
call fcn.3005b486
cmp dword [0x3008b610], 0
je 0x3002ed30
mov eax, dword [0x3008b614]
mov dword [esi + 4], eax
jmp 0x3002ed37
mov dword [esi + 4], 0x32
cmp dword [ebp - 4], 0
jne 0x3002ed4c
mov dword [esi + 0x218], 0x300032e4
jmp 0x3002edcc
mov dword [esi + 0x218], 0x30003308
jmp 0x3002edcc
push edi
push ebx
push 0x300226e0
call fcn.3005b486
cmp dword [0x3008b610], 0
je 0x3002ed77
mov eax, dword [0x3008b614]
mov dword [esi + 4], eax
jmp 0x3002ed7e
mov dword [esi + 4], 0x32
cmp dword [ebp - 4], 0
jne 0x3002ed90
mov dword [esi + 0x218], 0x300032d4
jmp 0x3002edcc
mov dword [esi + 0x218], 0x300032f4
jmp 0x3002edcc
push edi
push ebx
push 0x300226cc
call fcn.3005b486
cmp dword [0x3008b610], 0
je 0x3002edbb
mov eax, dword [0x3008b614]
mov dword [esi + 4], eax
jmp 0x3002edc2
mov dword [esi + 4], 0x32
mov dword [esi + 0x218], 0x300032c4
cmp dword [ebp + 0xc], 0
je 0x3002ede0
push esi
call fcn.3002e9d7
test eax, eax
je 0x3002ec5e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x3002f358
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
xor eax, eax
and edi, 7
cmp dword [ebp + 0xc], eax
mov dword [ebp - 4], 4
jne 0x3002f384
push 0x30003208
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x3002f3e0
push ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
push eax
mov ebx, 0x30003208
push ebx
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x3002f3b8
cmp eax, 2
jne 0x3002f3d3
mov eax, dword [esi]
and eax, 0x10000000
push eax
push edi
call fcn.3002f294
mov dword [ebp + 8], eax
or dword [ebp + 8], edi
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push ebx
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x3002f3df
push 0
push 0x30303030
call fcn.300435b4
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x300308f6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x300309bf
push esi
push edi
push eax
call fcn.30059f43
mov esi, eax
inc esi
mov eax, esi
shl eax, 2
push eax
call fcn.30043102
mov edi, eax
push esi
push edi
push dword [ebx]
mov dword [ebp - 8], edi
call fcn.3005b404
mov eax, edi
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 4], edi
mov edi, dword [ebx]
je 0x300309af
jmp 0x3003093f
mov eax, dword [ebp + 8]
cmp word [eax], cx
je 0x30030960
cmp word [eax], 0x7c
je 0x30030951
inc eax
inc eax
cmp word [eax], cx
jne 0x30030944
cmp word [eax], cx
je 0x30030960
mov word [eax], cx
inc eax
inc eax
mov dword [ebp + 8], eax
jmp 0x30030963
mov dword [ebp + 8], ecx
push dword [ebp - 4]
call fcn.3003dcde
cmp eax, 0xffffffff
jne 0x3003097b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x300309a3
cmp edi, dword [ebx]
je 0x30030986
mov word [edi], 0x7c
inc edi
inc edi
mov eax, edi
sub eax, dword [ebx]
mov ecx, esi
sar eax, 1
sub ecx, eax
push ecx
push edi
push dword [ebp - 4]
call fcn.3005b404
push edi
call fcn.30059f43
lea edi, [edi + eax*2]
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
mov dword [ebp - 4], eax
jne 0x3003093c
cmp edi, dword [ebx]
pop edi
pop esi
jne 0x300309b7
mov dword [ebx], ecx
push dword [ebp - 8]
call fcn.3004315f
pop ebx
leave
ret 4
Function at 0x300309c4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x460], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
je 0x30030c05
mov eax, dword [esi]
test eax, eax
je 0x30030c05
push eax
call fcn.30059f43
mov edi, eax
inc edi
mov eax, edi
shl eax, 2
push eax
mov dword [ebp - 0x468], edi
call fcn.30043102
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x46c], ebx
je 0x30030c08
push edi
push ebx
push dword [esi]
call fcn.3005b404
mov dword [ebp - 0x464], ebx
jmp 0x30030a39
cmp word [ebx], 0x3b
je 0x30030a3f
inc ebx
inc ebx
cmp word [ebx], 0
jne 0x30030a31
cmp word [ebx], 0
mov edi, ebx
je 0x30030a4f
and word [ebx], 0
inc ebx
inc ebx
jmp 0x30030a51
xor ebx, ebx
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x478], eax
je 0x30030bdb
and dword [ebp - 0x470], 0
jmp 0x30030a8a
movzx eax, word [edi]
test ax, ax
je 0x30030aac
cmp ax, 0x5c
je 0x30030a96
dec edi
dec edi
cmp edi, dword [ebp - 0x46c]
jae 0x30030a7c
jmp 0x30030aac
push dword [ebp - 0x464]
and word [edi + 2], 0
call fcn.30059f43
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x468]
lea eax, [eax*4 + 0x400]
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x430]
push eax
call fcn.30059f43
mov edi, eax
add edi, dword [ebp - 0x470]
mov eax, 0x104
cmp edi, eax
jae 0x30030bb4
and word [ebp - 0x20c], 0
cmp dword [ebp - 0x470], 0
je 0x30030b09
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x464]
call fcn.3005b404
mov eax, 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.3005b486
lea eax, [ebp - 0x20c]
push eax
call fcn.30040f9d
test eax, eax
jne 0x30030bb4
mov eax, dword [ebp - 0x460]
lea ecx, [edi + eax + 1]
cmp ecx, dword [ebp - 0x468]
jle 0x30030b74
push dword [ebp - 0x474]
push dword [esi]
call fcn.300431ce
test eax, eax
je 0x30030bfa
add dword [ebp - 0x468], 0x100
add dword [ebp - 0x474], 0x400
mov dword [esi], eax
mov eax, dword [ebp - 0x460]
test eax, eax
je 0x30030b87
mov ecx, dword [esi]
mov word [ecx + eax*2], 0x3b
inc eax
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x468]
sub ecx, eax
lea edi, [eax + eax]
mov eax, dword [esi]
push ecx
add eax, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.3005b404
mov eax, dword [esi]
add eax, edi
push eax
call fcn.30059f43
add dword [ebp - 0x460], eax
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x30030abf
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
mov dword [ebp - 0x464], ebx
jne 0x30030a39
cmp dword [ebp - 0x460], ebx
jne 0x30030bfa
push dword [esi]
call fcn.3004315f
and dword [esi], ebx
push dword [ebp - 0x46c]
call fcn.3004315f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.30069776
leave
ret 4
Function at 0x30030de0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x30030dfd
xor eax, eax
inc eax
leave
ret
mov eax, dword [ebp - 4]
and al, 0x10
sub al, 0x10
neg al
sbb eax, eax
inc eax
leave
ret

Function at 0x30031171
Capabilities:
Connect to http server

Disassembly:
push ebx
push esi
xor ebx, ebx
call fcn.3003db37
test eax, eax
mov esi, 0x300bcfe4
je 0x30031190
push esi
push 0x30004350
call fcn.3003dc56
pop ecx
pop ecx
mov eax, dword [0x300bd9ec]
test eax, eax
je 0x3003119e
mov ebx, 0x800000
neg eax
push 1
sbb eax, eax
push ebx
and eax, 0x16b
add eax, 0x50
push 3
movzx ecx, ax
mov eax, 0x30002a15
push eax
push eax
push ecx
push esi
push dword [0x300bcfb0]
call dword [sym.imp.WININET.dll_InternetConnectA]
xor ecx, ecx
cmp eax, ecx
pop esi
mov dword [0x300bcfb4], eax
mov dword [0x300bfc48], 1
mov dword [0x300bcfbc], ecx
pop ebx
jne 0x30031207
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x30031220
call fcn.3003db37
test eax, eax
je 0x30031204
push 0x30004338
call fcn.3003dbd1
xor eax, eax
ret
push ecx
push ecx
push 0x1427
push dword [0x300d1730]
mov dword [0x300bfc48], ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
ret

Function at 0x300313bc
Capabilities:
Send data

Disassembly:
mov eax, dword [0x300bd9fc]
push edi
xor edi, edi
cmp eax, edi
jne 0x300313e0
push edi
push edi
push 0x1427
push dword [0x300d1730]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
pop edi
ret
mov ecx, dword [0x300bd9f0]
push esi
push 0x300bd9f8
push dword [0x300bd9f4]
add ecx, eax
push ecx
push dword [0x300bcfb8]
xor esi, esi
inc esi
mov dword [0x300bfc48], esi
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x30031438
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
je 0x30031460
call fcn.3003db37
test eax, eax
je 0x30031434
push edi
push 0x300043b8
call fcn.3003dc56
pop ecx
pop ecx
xor eax, eax
jmp 0x30031462
cmp dword [0x300bcf84], 3
mov dword [0x300bfc48], edi
jne 0x3003144d
mov dword [0x300d1724], esi
push edi
push edi
push 0x1427
push dword [0x300d1730]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, esi
pop esi
pop edi
ret
Function at 0x30032271
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.30032137
test eax, eax
je 0x300322d2
push dword [0x3008b53c]
call fcn.30040f9d
test eax, eax
jne 0x300322cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.3003db37
test eax, eax
je 0x300322b1
push dword [0x3008b53c]
push 0x30004584
call fcn.3003dc56
pop ecx
pop ecx
call fcn.3003db37
test eax, eax
je 0x300322c9
push dword [ebp - 4]
push 0x30004560
call fcn.3003dc56
pop ecx
pop ecx
xor eax, eax
jmp 0x300322e4
xor eax, eax
inc eax
jmp 0x300322e4
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
neg eax
sbb eax, eax
neg eax
leave
ret 4
Function at 0x300365ff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 8

Function at 0x30039c8a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebx + 0xc], eax
je 0x30039cad
push 0x14
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x30039d90
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.300351dc
mov eax, dword [0x300cb508]
cmp eax, dword [0x300cb504]
mov esi, 0x447
je 0x30039d17
push 1
push 0x66
push 4
push edi
call fcn.300374cf
push 1
push 0xa2
push 0x3ed
push edi
call fcn.300374cf
push 1
push 0xa3
push 3
push edi
call fcn.300374cf
push 1
push 0xb0
push esi
push edi
call fcn.300374cf
push 1
push 0xb1
push 0x453
push edi
call fcn.300374cf
cmp dword [ebx + 0x34], 0
je 0x30039d4d
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 4
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 4
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x30039d78
mov eax, dword [ebx + 8]
test byte [eax], 2
je 0x30039d78
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [ebp + 0xc]
and dword [ebx + 0x28], 0
push ebx
push edi
call fcn.30039b6f
push 0x3ec
push edi
call fcn.300365ff
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x3003cb8a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x300222cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
imul esi, esi, 0x18
xor ebx, ebx
cmp dword [esi + 0x3008b490], ebx
je 0x3003cbc5
mov ecx, dword [esi + 0x3008b494]
cmp ecx, dword [ebp + 0x10]
jne 0x3003cbc5
xor eax, eax
inc eax
jmp 0x3003cca2
push edi
push eax
push 0x300016c0
push 0x30004d54
mov edi, 0x104
lea eax, [ebp - 0x108]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [esi + 0x3008b4a0]
add esp, 0x14
cmp eax, ebx
je 0x3003cc1a
cmp byte [eax], bl
je 0x3003cc1a
push edi
lea eax, [ebp - 0x108]
push eax
push 0x300041fc
call fcn.3005b4d7
push edi
lea eax, [ebp - 0x108]
push eax
push dword [esi + 0x3008b4a0]
call fcn.3005b4d7
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.3006b4aa
test eax, eax
je 0x3003cc7f
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x114]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x3003cc7f
push 4
pop edi
push edi
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
push dword [esi + 0x3008b4a4]
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x3003cc83
xor eax, eax
jmp 0x3003cca1
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x3008b494], eax
xor eax, eax
inc eax
mov dword [esi + 0x3008b498], edi
mov dword [esi + 0x3008b490], eax
mov dword [esi + 0x3008b49c], ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.30069776
leave
ret 0xc

Function at 0x3003d0ca
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
call fcn.30059eb2
mov esi, eax
inc esi
push esi
call fcn.30043102
mov edi, eax
test edi, edi
je 0x3003d107
push esi
push edi
push dword [ebp + 8]
call fcn.3005b426
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x3003d060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret 4
Function at 0x3003d122
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x3003d137
xor eax, eax
jmp 0x3003d19e
push edi
xor edi, edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x3003d191
cmp eax, edi
je 0x3003d191
push edi
push eax
push edi
push 8
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x3003d191
push edi
push edi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x3003d18c
push dword [esi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esi]
mov dword [esi + 4], edi
call ebx
or dword [esi], 0xffffffff
jmp 0x3003d19b
xor eax, eax
inc eax
jmp 0x3003d19d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x3003d7ec
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
cmp word [0x300d2400], 0
je 0x3003d83a
push esi
push 0x300d2400
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x3003d839
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x14]
call fcn.30059f43
add eax, eax
push eax
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push 0
push dword [ebp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
pop ebp
ret 0x14

Function at 0x3003db4b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
push edi
push edi
push 0x80
push 4
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call fcn.3005ec81
mov esi, eax
cmp esi, 0xffffffff
jne 0x3003dba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [ebp - 4], eax
je 0x3003db8d
cmp eax, 0x21
je 0x3003db8d
cmp eax, 0x36
jne 0x3003dbca
inc ebx
cmp ebx, 5
jge 0x3003dbca
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x3003db56
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.30059eb2
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x3003dcde
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]