joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30010e97
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x30034be8]
push esi
push edi
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x10]
push eax
push 0x2001b
xor edi, edi
push edi
mov esi, 0x30003798
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x30010ee6
push esi
push 0x30003758
call fcn.3000ff32
pop ecx
pop ecx
jmp 0x30010f56
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x30003720
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30010f56
push ebx
mov ebx, 0x300036d0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
add ecx, ecx
mov edi, ebx
lea esi, [ebp - 0xc]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x30010f23
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x30010f55
mov esi, 0x30003720
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
push ebx
push esi
push 0x30003798
jne 0x30010f48
push 0x30003680
jmp 0x30010f4d
push 0x30003618
call fcn.3000ff32
add esp, 0x10
pop ebx
cmp dword [ebp - 0x10], 0
pop edi
pop esi
je 0x30010f67
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x74]
call fcn.3001f57d
add ebp, 0x78
leave
ret

Function at 0x3001100b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x30034be8]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp + 8], eax
je 0x300110fa
cmp dword [ebp + 0xc], eax
je 0x300110fa
cmp dword [ebp + 0x10], eax
je 0x300110fa
cmp dword [ebp + 0x14], eax
je 0x300110fa
cmp dword [ebp + 0x18], eax
je 0x300110fa
test byte [0x30077434], 1
push ebx
push esi
push edi
mov edi, 0x3007742c
jne 0x30011072
or dword [0x30077434], 1
mov ecx, edi
call fcn.3000cc94
push 0x30021c82
call fcn.3001f5ed
pop ecx
mov esi, dword [ebp + 0x1c]
push 0x30003844
push 0xa
lea eax, [ebp - 0x18]
push eax
lea ebx, [esi + 2]
call fcn.3000cd1d
push ebx
mov ecx, edi
call fcn.3000cd95
mov edi, eax
test edi, edi
je 0x300110a3
push 0x30003824
call fcn.3000fdf9
pop ecx
jmp 0x300110f3
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push ebx
push dword [0x3007742c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esi - 1]
cmp eax, ecx
jbe 0x300110c9
push 0x18
pop edi
jmp 0x300110f3
lea eax, [ebp - 0x18]
push eax
push dword [0x3007742c]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x300110e2
push dword [ebp + 0x14]
jmp 0x300110e8
push dword [0x3007742c]
push esi
push dword [ebp + 0x18]
call fcn.3000ce3d
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
jmp 0x300110fd
push 0x57
pop eax
mov ecx, dword [ebp - 4]
call fcn.3001f57d
leave
ret 0x18
Function at 0x300112ef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x30034be8]
push ebx
push edi
mov dword [ebp + 0x198], eax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x74], bx
mov ecx, 0x82
lea edi, [ebp - 0x72]
rep stosd dword es:[edi], eax
push 0x30002a00
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x7c], 0x20a
mov dword [ebp - 0x80], 1
call fcn.300193fa
test eax, eax
je 0x30011349
push 0x300038dc
call fcn.3000fdf9
pop ecx
jmp 0x30011396
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x30002ae8
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x30011370
push 0x300038a8
jmp 0x30011341
cmp word [ebp - 0x74], 0
je 0x30011394
lea eax, [ebp - 0x74]
push eax
push 0x105
push 0x30056888
call fcn.3000cd1d
xor ebx, ebx
mov dword [0x30076cfc], eax
inc ebx
jmp 0x30011396
xor ebx, ebx
cmp dword [ebp - 0x78], 0
je 0x300113a5
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, ebx
pop ebx
call fcn.3001f57d
add ebp, 0x19c
leave
ret

Function at 0x30011551
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3f8]
sub esp, 0x478
mov eax, dword [0x30034be8]
push ebx
push edi
mov dword [ebp + 0x3f4], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor edi, edi
push edi
push 0x300029a0
push SysReAllocString
mov dword [ebp - 0x78], edi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x3001162c
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x3a4]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push dword [ebp + 0x400]
mov dword [ebp - 0x7c], 0x27
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3001162c
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp + 0x3a4]
push eax
push dword [ebp + 0x400]
mov dword [ebp - 0x7c], 0x105
call sub.msi.dll_MsiAdvertiseScriptW
cmp eax, 3
je 0x300115ed
cmp eax, 4
jne 0x3001162c
push dword [ebp + 0x400]
lea eax, [ebp - 0x74]
push 0x300039cc
push 0x105
push eax
call fcn.3000d759
add esp, 0x10
push 1
push edi
mov dword [0x30076cfc], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x198]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x3001162c
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x78], edi
je 0x3001163a
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x3f4]
pop edi
mov eax, ebx
pop ebx
call fcn.3001f57d
add ebp, 0x3f8
leave
ret 4
Function at 0x300119b7
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x30034be8]
push ebx
push esi
push dword [ebp + 0x1f0]
mov dword [ebp + 0x1e4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 0x32
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
and dword [ebp - 0x2c], 0
mov ebx, eax
test ebx, ebx
je 0x30011ab4
push edi
push dword [ebp + 0x1f0]
push 0x30003bfc
push esi
push ebx
call fcn.3000d759
add esp, 0x10
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x30056468
stosd dword es:[edi], eax
push 0x105
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x80], 0x44
call fcn.3000cd1d
push 0x30003bd0
mov dword [0x30076cfc], eax
call fcn.3000fe20
lea eax, [ebp - 0x28]
push eax
call fcn.3000fe20
push ebx
call fcn.3000fe20
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
xor eax, eax
push eax
push eax
push 0x20
push 1
push eax
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x30011a9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x30003bac
mov dword [ebp - 0x2c], eax
call fcn.3000fe20
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call fcn.3000db14
jmp 0x30011aaf
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov eax, dword [ebp - 0x2c]
jmp 0x30011ab9
mov eax, 0xfffffed3
mov ecx, dword [ebp + 0x1e4]
pop esi
pop ebx
call fcn.3001f57d
add ebp, 0x1e8
leave
ret 4
Function at 0x30011ad0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov eax, 0x11264
lea ebp, [esp - 0x111e4]
call fcn.3001f58a
mov eax, dword [0x30034be8]
push esi
push edi
push 0x30003d50
mov dword [ebp + 0x111e0], eax
call fcn.3000fe20
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
push 0x105
lea eax, [ebp + 0x10fd4]
push eax
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x40
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test edi, edi
je 0x30011bcb
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + 0x10fd4]
push eax
call esi
cmp edi, eax
jne 0x30011bcb
push 0x800
lea eax, [ebp - 0x2c]
push eax
push 0x46
call fcn.3000ffad
mov edi, eax
test edi, edi
je 0x30011bc4
lea eax, [ebp - 0x2c]
push eax
call esi
cmp edi, eax
jne 0x30011bc4
mov esi, 0x30056468
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x10fd4]
push eax
push 0x30003d34
lea eax, [ebp + 0xfd4]
push 0x8000
push eax
call fcn.3000d759
add esp, 0x18
mov dword [0x30076cfc], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push 0
push 0x20
push 1
push 0
push 0
lea eax, [ebp + 0xfd4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x30011bbd
xor eax, eax
jmp 0x30011bda
push 0x30003cf8
jmp 0x30011bd0
push 0x30003c98
jmp 0x30011bd0
push 0x30003c28
call fcn.3000fe20
mov eax, 0xffffff2f
mov ecx, dword [ebp + 0x111e0]
pop edi
pop esi
call fcn.3001f57d
add ebp, 0x111e4
leave
ret
Function at 0x3001217b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0x400
lea edi, [esi + esi]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 8]
mov ebx, eax
push esi
push ebx
push 0x30003f28
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
add esi, 0xfffffffe
cmp eax, esi
jb 0x300121c3
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x8000
jle 0x30012186
xor eax, eax
jmp 0x3001226b
xor edi, edi
cmp ebx, edi
je 0x300121bc
mov esi, ebx
mov ax, word [esi]
cmp ax, di
je 0x30012207
cmp ax, 0x3b
je 0x300121f8
push 0x30003f08
call fcn.3000fe20
push esi
call fcn.3000fe20
push 0x30076cf4
push esi
call fcn.30011722
test eax, eax
jne 0x300121bc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jne 0x300121cb
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x30077198], edi
jne 0x3001225e
cmp dword [0x30077190], edi
jne 0x3001225e
cmp dword [0x30077194], edi
jne 0x3001225e
cmp dword [0x3007719c], edi
jne 0x3001225e
lea eax, [ebp + 8]
push eax
push 1
push 0xa
push 0x300771a0
push 0x30003ee0
mov dword [ebp + 8], edi
call fcn.30011d70
cmp dword [ebp + 8], edi
je 0x30012268
push 0x30076cf0
push 0x30003ef0
call fcn.30011722
jmp 0x30012268
mov dword [0x300771b4], 1
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x3001255f
Capabilities:
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x30034be8]
push esi
push edi
lea ecx, [ebp - 0x7c]
mov dword [ebp + 0x198], eax
call fcn.3000cc94
mov esi, 0x105
push esi
mov edi, 0x30056468
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x300125a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x300126fe
push ebx
push edi
push esi
push 0x30077220
call fcn.3000cd1d
push 0x5c
push edi
mov dword [0x30076cfc], eax
call fcn.30015aae
push edi
push 0x30004390
mov ebx, eax
call fcn.3000ff32
test ebx, ebx
pop ecx
pop ecx
je 0x300125ec
and word [ebx], 0
add ebx, 2
push ebx
push esi
push 0x30056258
call fcn.3000cd1d
mov dword [0x30076cfc], eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.3000cd95
test eax, eax
mov dword [ebp - 0x80], eax
mov ebx, 0x30004374
jne 0x30012679
push dword [0x30076cf4]
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.3001185c
cmp dword [ebp - 0x78], 0
je 0x3001263b
lea ecx, [ebp - 0x7c]
call fcn.3000cfd4
push dword [ebp - 0x7c]
push esi
push edi
call fcn.3000cd1d
push edi
push 0x30004344
mov dword [0x30076cfc], eax
call fcn.3000ff32
pop ecx
pop ecx
push dword [0x30076cf4]
lea eax, [ebp - 0x7c]
push eax
push 0x30004328
call fcn.3001185c
cmp dword [ebp - 0x78], 0
je 0x30012679
push dword [ebp - 0x7c]
push esi
push 0x30056258
call fcn.3000cd1d
push 0x30056258
push 0x30004300
mov dword [0x30076cfc], eax
call fcn.3000ff32
pop ecx
pop ecx
cmp dword [0x30076f30], 0
jne 0x300126f3
push esi
push edi
call fcn.3000db43
test eax, eax
mov dword [ebp - 0x80], eax
je 0x3001269d
push 0x300042c0
call fcn.3000fdf9
pop ecx
jmp 0x300126fa
push edi
push ebx
push 0x300042b4
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.3000d759
add esp, 0x14
mov dword [0x30076cfc], eax
mov ebx, 0x30076cf0
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.30011722
push 0x30056258
push 0x30004328
push 0x300042b4
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.3000d759
add esp, 0x14
mov dword [0x30076cfc], eax
push ebx
lea eax, [ebp - 0x74]
push eax
call fcn.30011722
mov dword [ebp - 0x80], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [ebp - 0x80]
pop ebx
lea ecx, [ebp - 0x7c]
call fcn.3000cc9e
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, esi
pop esi
call fcn.3001f57d
add ebp, 0x19c
leave
ret
Function at 0x30012ee5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x30004ed4
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], edi
call fcn.30016694
push edi
call fcn.30019d12
cmp dword [ebp + 8], edi
mov ebx, eax
je 0x30012f1f
mov ebx, dword [ebp + 8]
cmp word [0x30036048], di
jne 0x30012f7a
call fcn.3000e739
test eax, eax
je 0x30012f7a
mov esi, 0x30076aa0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [eax*2 + 0x30076a9e], 0x5c
lea eax, [ebp - 0x2c]
push eax
push esi
jne 0x30012f54
push 0x3000211c
jmp 0x30012f59
push 0x30002110
push 0x105
push 0x30036048
call fcn.3000d759
mov dword [0x30076cfc], eax
add esp, 0x14
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x30012fdb
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
push 0x30004ec0
push esi
call dword [eax + 0x14]
cmp eax, edi
jl 0x30012fdb
mov eax, dword [ebp - 0x30]
cmp eax, edi
je 0x30012fdb
cmp word [eax + 0x104], di
je 0x30012fdb
cmp dword [0x30076f30], edi
jne 0x30012fdb
cmp dword [0x30034110], edi
je 0x30012fdb
push dword [0x30034118]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x30012fca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x30]
push esi
add eax, 0x104
push eax
call fcn.30018c26
mov ebx, eax
push 0x30004e90
call fcn.3000fe20
call fcn.3000fe6a
push ebx
push 0x30004e6c
call fcn.3000ff32
cmp dword [0x30056a98], edi
pop ecx
pop ecx
je 0x30013030
xor esi, esi
cmp dword [0x30056a94], edi
jle 0x3001301f
mov eax, dword [0x30056a98]
push dword [eax + esi*4]
call fcn.3001f22f
inc esi
cmp esi, dword [0x30056a94]
jl 0x30013009
push dword [0x30056a98]
call fcn.3001f22f
mov dword [0x30056a98], edi
cmp dword [0x30077170], edi
je 0x3001303d
call fcn.3001f1ea
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.3001f57d
leave
ret 0xc
Function at 0x3001354e
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push 0x30005010
mov dword [ebp + 0x194], eax
call fcn.3000fe20
push dword [ebp + 0x1a0]
call fcn.3000fe20
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x1a0]
xor esi, esi
mov dword [ebp - 0x80], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, dword [ebp + 0x1a8]
mov ebx, dword [ebp + 0x1ac]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [edi], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], esi
mov dword [ebx], esi
mov dword [ebp - 0x70], eax
mov esi, ecx
test esi, esi
jne 0x30013628
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x30004ff4
mov dword [ebp - 0x74], eax
call fcn.3000fe20
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push esi
push dword [ebp + 0x1a0]
call sub.VERSION.dll_GetFileVersionInfoW
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x300136c6
xor esi, esi
cmp dword [ebp + 0x1a4], esi
lea eax, [ebp - 0x70]
push eax
jne 0x3001364a
lea eax, [ebp - 0x7c]
push eax
push 0x30001920
push dword [ebp - 0x74]
mov dword [ebp - 0x70], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x30013620
cmp dword [ebp - 0x70], esi
je 0x30013620
mov eax, dword [ebp - 0x7c]
cmp eax, esi
jne 0x3001367c
xor esi, esi
inc esi
jmp 0x300136c6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x300136d5
call edi
push eax
push 0x30004fc4
call fcn.3000fea4
jmp 0x300136d5
lea eax, [ebp - 0x78]
push eax
push 0x30002880
push dword [ebp - 0x74]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x30013620
cmp dword [ebp - 0x70], esi
je 0x30013620
cmp dword [ebp - 0x78], esi
je 0x30013620
push ebx
push edi
push dword [ebp - 0x78]
call fcn.300103e8
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x30013686
mov ecx, dword [eax + 0x10]
mov dword [edi], ecx
mov eax, dword [eax + 0x14]
mov dword [ebx], eax
test esi, esi
jne 0x300136c6
movzx eax, word [ebx]
push eax
movzx eax, word [ebx + 2]
push eax
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
push dword [ebp + 0x1a0]
lea eax, [ebp - 0x6c]
push 0x30004f90
push 0xff
push eax
call fcn.3000d759
mov dword [0x30076cfc], eax
add esp, 0x20
lea eax, [ebp - 0x6c]
push eax
call fcn.3000fe20
cmp dword [ebp - 0x74], 0
je 0x300136d5
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 0x194]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebx
call fcn.3001f57d
add ebp, 0x198
leave
ret 0x10
Function at 0x30014223
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push dword [0x30076cf4]
mov edi, 0x30002730
push edi
mov dword [ebp - 4], eax
mov esi, 0x400
call fcn.300106b5
test eax, eax
jne 0x30014350
push dword [0x30076cf0]
push edi
call fcn.300106b5
test eax, eax
jne 0x30014350
cmp dword [0x300771cc], eax
jne 0x30014350
lea edi, [esi + esi]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 8]
mov ebx, eax
push esi
push ebx
push 0x300054f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
add esi, 0xfffffffe
cmp eax, esi
jb 0x300142ad
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x8000
jle 0x30014275
jmp 0x300142b1
test ebx, ebx
jne 0x300142b8
xor eax, eax
jmp 0x30014364
mov esi, ebx
mov dword [ebp + 8], 1
mov edi, 0x105
test esi, esi
je 0x30014344
mov ax, word [esi]
test ax, ax
je 0x30014344
cmp ax, 0x3b
je 0x3001432d
push 0x3d
push esi
call fcn.30015a7f
mov esi, eax
test esi, esi
je 0x3001433e
inc esi
inc esi
push esi
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.3000cd1d
mov dword [0x30076cfc], eax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.3000dfb9
push 0x300054cc
call fcn.3000fe20
lea eax, [ebp - 0x210]
push eax
call fcn.3000fe20
lea eax, [ebp - 0x210]
push eax
call fcn.300141ad
mov dword [ebp + 8], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp dword [ebp + 8], 0
jne 0x300142c6
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
jmp 0x30014364
push 0x30056aa0
push 0x30005448
call fcn.3000ff32
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 4
Function at 0x300144e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x30034be8]
push ebx
push esi
xor ebx, ebx
cmp dword [0x300771c8], ebx
push edi
mov dword [ebp + 0x194], eax
mov edi, 0x105
mov esi, 0x30056678
jne 0x3001454f
push edi
push esi
call fcn.3000dfb9
test eax, eax
je 0x3001454f
push 0x5c
push esi
call fcn.30015a7f
test eax, eax
jne 0x3001454f
push esi
push 0x30056468
push 0x30002110
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.3000d759
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push edi
push esi
call fcn.3000cd1d
mov dword [0x30076cfc], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3001464d
push 0x3000563c
call fcn.3000fe20
push esi
call fcn.3000fe20
cmp dword [0x3007717c], ebx
jne 0x30014622
call fcn.30010955
test eax, eax
jne 0x30014622
push edi
mov ebx, 0x30076d18
push ebx
push 0x30002184
push 0x30002b98
push 0x30002b04
call fcn.3001038d
test eax, eax
je 0x30014622
lea ecx, [ebp - 0x80]
call fcn.3000cc94
push ebx
lea ecx, [ebp - 0x80]
call fcn.3000ce85
test eax, eax
je 0x300145c7
push 0x5c
push 0
call fcn.3000d12f
jmp 0x300145f9
lea eax, [ebp - 0x80]
push eax
call fcn.3000e07c
test eax, eax
je 0x300145e0
push esi
push 0x58
push 0
call fcn.3000d99f
jmp 0x300145f9
push dword [ebp - 0x80]
push edi
push ebx
call fcn.3000cd1d
test eax, eax
jge 0x30014603
push 0x300055e8
call fcn.3000ff32
pop ecx
lea ecx, [ebp - 0x80]
call fcn.3000cc9e
jmp 0x30014660
push ebx
push 0x300055b8
call fcn.3000ff32
pop ecx
pop ecx
lea ecx, [ebp - 0x80]
mov dword [0x3007717c], 1
call fcn.3000cc9e
push esi
call fcn.30014223
test eax, eax
jne 0x30014631
push esi
push 0x5a
jmp 0x30014644
push dword [ebp + 0x1a0]
push esi
call fcn.3001217b
test eax, eax
jne 0x30014648
push esi
push 0x5b
push 0
jmp 0x3001465b
xor eax, eax
inc eax
jmp 0x30014662
push 0x30005588
call fcn.3000fe20
push esi
push 0x3f
push ebx
call fcn.3000d99f
xor eax, eax
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
pop ebx
call fcn.3001f57d
add ebp, 0x198
leave
ret 4
Function at 0x3001518d
Capabilities:
Accept command line arguments
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xac
mov eax, dword [0x30034be8]
push ebx
push esi
mov dword [ebp + 0x70], eax
xor ebx, ebx
xor esi, esi
call fcn.3001f1e7
cmp eax, ebx
jge 0x300151cc
push eax
push 0x30001400
call fcn.3000fdf9
push 0x30005c94
call fcn.3000fdf9
add esp, 0xc
jmp 0x3001538c
mov dword [0x30077170], 1
call fcn.300104cb
cmp dword [0x30076d08], 0x1f4
jae 0x30015200
push 0x300043b0
push 0x47e
call fcn.3000ff59
mov eax, 0xffffff37
jmp 0x3001538e
call fcn.30019a87
call fcn.300197c7
mov eax, dword [ebp + 0x7c]
mov dword [0x30076d00], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x30056a94
push eax
mov dword [0x30077218], eax
call fcn.3001017f
push 0x30005c18
mov dword [0x30056a98], eax
call fcn.3000fe20
call fcn.3000fe6a
push 0x105
push 0x30056468
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x3001525c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x3001538e
call fcn.30010a00
call fcn.30010aba
cmp dword [0x30077184], ebx
je 0x300152bd
call fcn.3001c580
test eax, eax
jne 0x300152a9
call fcn.3001c5a9
test eax, eax
jne 0x300152a9
push 5
push ebx
call fcn.30010605
test eax, eax
jne 0x300152a9
push 0xc
push ebx
call fcn.30010605
test eax, eax
jne 0x300152a9
call fcn.30010bac
test eax, eax
jne 0x300152a9
cmp dword [0x30077188], ebx
je 0x300152bd
push 0x30005be4
call fcn.3000fe20
mov eax, 0xffffff38
jmp 0x3001538e
call fcn.30010afa
call fcn.3001304e
test eax, eax
jne 0x300152ef
push 0x30005b98
call fcn.3000fe20
cmp dword [0x30077184], ebx
jne 0x300152e5
push 0x32
push ebx
call fcn.3000d12f
mov eax, 0xffffff33
jmp 0x3001538e
call fcn.300104cb
call fcn.30010e97
push 0x30002a00
push 0x51
lea eax, [ebp - 0x34]
push eax
push 0xfffffc17
call fcn.3001a1e8
mov esi, eax
cmp esi, ebx
jne 0x3001534b
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.300193fa
mov esi, eax
cmp esi, ebx
jne 0x3001534b
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x38], ebx
jne 0x3001534b
lea eax, [ebp - 0x34]
push eax
push dword [0x300341b8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push edi
xor eax, eax
cmp esi, ebx
mov ecx, 0x1076
mov edi, 0x30077438
rep stosd dword es:[edi], eax
pop edi
je 0x3001536b
push 0x30005b38
call fcn.3000fe20
jmp 0x3001538c
call fcn.30010f74
test eax, eax
jne 0x3001537b
mov eax, 0xfffffe6b
jmp 0x3001538e
push 0x30076cf0
push 0x30005b0c
call fcn.30011722
mov esi, eax
mov eax, esi
mov ecx, dword [ebp + 0x70]
pop esi
pop ebx
call fcn.3001f57d
add ebp, 0x74
leave
ret 4