joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3002e550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x300046cc
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x3002e578
xor eax, eax
jmp 0x3002e5ac
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 4
push 0
push 0
push 0x30004718
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
leave
ret 4

Function at 0x3002e60e
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x30004788
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3002e660
push edi
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push 0x30004750
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
je 0x3002e664
xor eax, eax
jmp 0x3002e66d
xor eax, eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
pop esi
leave
ret
Function at 0x3002e670
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x300930a4]
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
xor eax, eax
mov word [ebp - 0x61c], si
mov ecx, 0x103
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x20c], si
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
cmp edi, esi
mov dword [ebp - 0x620], esi
je 0x3002e7ce
call fcn.3002e60e
test eax, eax
je 0x3002e6e8
cmp dword [ebp + 0xc], esi
je 0x3002e6e8
call fcn.30022690
test eax, eax
je 0x3002e7ce
push 0x300049c4
jmp 0x3002e72d
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x620]
push ecx
push esi
push 0x2001f
and eax, 0x10000000
push esi
neg eax
push esi
sbb eax, eax
push esi
neg eax
add eax, 0x80000001
push 0x30004788
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x3002e737
call fcn.30022690
test eax, eax
je 0x3002e7ce
push 0x300049a4
call fcn.3002272a
jmp 0x3002e7ce
cmp dword [ebp + 0xc], esi
jne 0x3002e74f
push 0x3000472c
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x3002e7ce
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x3002e7ce
dec eax
cmp word [ebp + eax*2 - 0x20c], 0x5c
jne 0x3002e762
push 0x74
mov word [ebp + eax*2 - 0x20c], si
push 0x30004988
lea eax, [ebp - 0x20c]
push eax
push 0x30004970
lea eax, [ebp - 0x61c]
push 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call fcn.3004b7c1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x61c]
push eax
push 1
push esi
push 0x3000472c
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.3005f839
leave
ret 8

Function at 0x300300c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call fcn.300312ce
test eax, eax
je 0x300300d8
xor eax, eax
inc eax
jmp 0x3003015e
push esi
push edi
xor esi, esi
push esi
push 0x80
push 2
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x30030117
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.30022690
test eax, eax
je 0x30030155
push dword [ebp - 4]
push 0x30004e44
jmp 0x3003014e
push ebx
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
pop ebx
jne 0x30030159
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.30022690
test eax, eax
je 0x30030155
push dword [ebp - 4]
push 0x30004e24
call fcn.300227ad
pop ecx
pop ecx
xor eax, eax
jmp 0x3003015c
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc
Function at 0x300303b7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0xa80]
sub esp, 0xb00
mov eax, dword [0x300930a4]
push ebx
push esi
mov esi, dword [ebp + 0xa88]
xor edx, edx
lea ebx, [esi + 0x21c]
cmp dword [ebx], edx
mov dword [ebp + 0xa7c], eax
mov dword [ebp - 0x80], edx
jne 0x30030414
push 0x106
push 5
push 5
push 0x44c
push ebx
call fcn.300515b0
test eax, eax
jne 0x30030435
call fcn.30022690
test eax, eax
je 0x3003043f
push 0x30004ed8
call fcn.3002272a
jmp 0x3003043f
mov eax, dword [ebx]
movzx ecx, word [eax]
push ecx
push edx
push eax
call fcn.3005126d
test eax, eax
jne 0x30030435
call fcn.30022690
test eax, eax
je 0x3003043f
push 0x30004eb0
jmp 0x3003040d
push esi
call fcn.3002e3d6
test eax, eax
jne 0x30030446
xor eax, eax
jmp 0x30030593
push edi
lea eax, [esi + 0xc]
mov esi, 0x104
push esi
lea ecx, [ebp + 0x1d8]
push ecx
push eax
call fcn.3004cae8
push esi
lea eax, [ebp + 0x1d8]
push eax
push 0x30004ea0
call fcn.3004cb2a
lea eax, [ebp + 0x3e0]
push eax
lea eax, [ebp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
je 0x3003056a
test dword [ebp + 0x3e0], 0xffffffef
je 0x3003053f
xor eax, eax
mov ecx, 0x113
lea edi, [ebp + 0x630]
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp + 0x630]
push eax
mov eax, dword [ebp + 0xa88]
add eax, 0xc
push eax
call fcn.3004cae8
push esi
lea eax, [ebp + 0x630]
push eax
push 0x30002e98
call fcn.3004cb2a
push esi
lea eax, [ebp + 0x630]
push eax
lea eax, [ebp + 0x40c]
push eax
call fcn.3004cb2a
push esi
lea eax, [ebp + 0x838]
push eax
lea eax, [ebp + 0x630]
push eax
call fcn.3002f478
test eax, eax
je 0x30030560
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x30030538
test dword [ebp - 0x78], 0xffffffef
je 0x30030538
mov eax, dword [ebx]
lea ecx, [ebp + 0x630]
push ecx
push eax
call fcn.300510f3
cmp eax, 0xffffffff
je 0x300305aa
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp + 0x3e0]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x30030560
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x7c], 0xffffffff
cmp dword [ebp - 0x7c], 0xffffffff
jne 0x3003048f
mov dword [ebp - 0x80], 1
mov esi, dword [ebp + 0xa88]
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x80], 0
pop edi
jne 0x30030590
push esi
call fcn.3003022c
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0xa7c]
pop esi
pop ebx
call fcn.3005f839
add ebp, 0xa80
leave
ret 4
call fcn.30022690
test eax, eax
je 0x30030571
push 0x30004e78
call fcn.3002272a
jmp 0x30030571
Function at 0x300305bf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 3], 0x10
push edi
mov edi, 0x104
lea ebx, [esi + 0xc]
je 0x30030622
push edi
push ebx
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
mov dword [ebp - 8], eax
je 0x300305fd
cmp eax, edi
jbe 0x30030656
call fcn.30022690
test eax, eax
je 0x30030799
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30004f70
call fcn.300227ad
pop ecx
pop ecx
jmp 0x30030799
push 1
push 0x1c
push ebx
push 0
mov dword [ebp + 8], SysReAllocString
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x30030656
call fcn.30022690
test eax, eax
je 0x30030799
push 0x30004f48
call fcn.3002272a
jmp 0x30030799
push edi
push ebx
push 0x30005450
call fcn.3004cb2a
lea ecx, [ebp - 8]
push ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push 0x300046cc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x3003069e
call fcn.30022690
test eax, eax
je 0x3003069a
push 0x30004f24
call fcn.3002272a
and dword [esi + 8], 0
mov eax, dword [esi]
and eax, 7
dec eax
je 0x30030759
dec eax
je 0x30030715
dec eax
dec eax
je 0x300306ce
call fcn.30022690
test eax, eax
je 0x30030799
mov eax, dword [esi]
and eax, 7
push eax
push 0x30004efc
jmp 0x30030616
push edi
push ebx
push 0x300054a0
call fcn.3004cb2a
cmp dword [0x300626e8], 0
je 0x300306ed
mov eax, dword [0x300626ec]
mov dword [esi + 4], eax
jmp 0x300306f4
mov dword [esi + 4], 0x32
cmp dword [ebp - 4], 0
jne 0x30030709
mov dword [esi + 0x218], 0x300047d8
jmp 0x30030789
mov dword [esi + 0x218], 0x300047fc
jmp 0x30030789
push edi
push ebx
push 0x3000548c
call fcn.3004cb2a
cmp dword [0x300626e8], 0
je 0x30030734
mov eax, dword [0x300626ec]
mov dword [esi + 4], eax
jmp 0x3003073b
mov dword [esi + 4], 0x32
cmp dword [ebp - 4], 0
jne 0x3003074d
mov dword [esi + 0x218], 0x300047c8
jmp 0x30030789
mov dword [esi + 0x218], 0x300047e8
jmp 0x30030789
push edi
push ebx
push 0x30005478
call fcn.3004cb2a
cmp dword [0x300626e8], 0
je 0x30030778
mov eax, dword [0x300626ec]
mov dword [esi + 4], eax
jmp 0x3003077f
mov dword [esi + 4], 0x32
mov dword [esi + 0x218], 0x300047b8
cmp dword [ebp + 0xc], 0
je 0x3003079d
push esi
call fcn.300303b7
test eax, eax
jne 0x3003079d
xor eax, eax
jmp 0x300307a0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x30030c7f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
xor eax, eax
and edi, 7
cmp dword [ebp + 0xc], eax
mov dword [ebp - 4], 4
jne 0x30030cab
push 0x300046fc
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x30030cf7
push ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
push eax
mov ebx, 0x300046fc
push ebx
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x30030cdf
cmp eax, 2
jne 0x30030cf6
mov eax, dword [esi]
and eax, 0x10000000
push eax
push edi
call fcn.30030bc3
mov dword [ebp + 8], eax
or dword [ebp + 8], edi
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push ebx
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x30031273
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x300312a1
xor eax, eax
jmp 0x300312c9
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x300312be
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x300312ce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 4

Function at 0x300312e5
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x300930a4]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x3003134a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x30031341
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop ebx
call fcn.3005f839
leave
ret

Function at 0x30031486
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3e8]
sub esp, 0x468
mov eax, dword [0x300930a4]
push esi
push edi
mov dword [ebp + 0x3e4], eax
push 0x10
xor eax, eax
pop ecx
push dword [ebp + 0x3f0]
mov dword [ebp - 0x80], 0x44
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.3004b7c1
cmp eax, 0x104
jle 0x300314d6
push 0x30005660
jmp 0x30031543
push dword [ebp + 0x3f4]
lea eax, [ebp - 0x2c]
push 0x6b
push dword [ebp + 0x3f0]
push 0x30005648
push 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x4000020
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x3003153e
lea eax, [ebp - 0x2c]
push eax
push 0x30005638
call fcn.300227ad
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
pop ecx
push dword [ebp - 0x3c]
call esi
push dword [ebp - 0x38]
call esi
jmp 0x30031549
push 0x30005604
call fcn.300227ad
pop ecx
mov ecx, dword [ebp + 0x3e4]
pop edi
pop esi
call fcn.3005f839
add ebp, 0x3e8
leave
ret 8
Function at 0x30032253
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0xc]
shl esi, 2
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.3004fc1e
test eax, eax
je 0x300323ef
mov ecx, esi
mov edx, ecx
push ebx
shr ecx, 2
push edi
mov edi, dword [ebp - 0xc]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 0xc], ebx
rep stosb byte es:[edi], al
mov dword [ebp - 0x14], esi
jle 0x300323e5
mov edi, dword [ebp + 8]
add edi, 0x10
mov dword [ebp - 0x10], edi
cmp dword [edi - 0x10], ebx
jne 0x300323d2
mov eax, dword [ebp - 0xc]
cmp dword [eax + esi*4], ebx
jne 0x300323d2
mov eax, dword [edi]
cmp byte [eax], 0
jne 0x300322c6
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jmp 0x300322e1
lea ecx, [ebp - 8]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x300322e1
mov dword [ebp - 8], ebx
cmp esi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
jge 0x300323bf
lea esi, [edi - 8]
push dword [edi]
push dword [esi + 8]
call fcn.30031cac
test eax, eax
jne 0x300323a7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor edi, edi
inc edi
mov dword [eax + ecx*4], edi
cmp dword [esi - 8], ebx
jne 0x300323a7
mov ecx, dword [ebp - 8]
cmp ecx, ebx
je 0x300323a7
mov eax, dword [esi + 4]
sub eax, ebx
je 0x3003240d
dec eax
je 0x3003240a
dec eax
je 0x300323f4
dec eax
jne 0x300323a7
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
mov dword [ebp + 8], ebx
push ecx
call fcn.30031b87
test eax, eax
je 0x300323a7
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
push 0x106
lea edi, [ebx + ebx]
push edi
call fcn.30050e9f
test eax, eax
mov dword [esi - 4], eax
je 0x30032397
push ebx
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esi], edi
mov dword [esi - 8], 1
cmp dword [ebp + 8], 0
je 0x300323a5
push dword [ebp + 8]
call fcn.30050db4
xor ebx, ebx
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
add esi, 0x18
cmp eax, dword [ebp + 0xc]
jl 0x300322f0
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
je 0x300323d2
cmp eax, ebx
je 0x300323d2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
add edi, 0x18
cmp esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
jl 0x300322a2
push dword [ebp - 0xc]
call fcn.3004fd1c
pop edi
pop ebx
pop esi
leave
ret 0xc
push 3
push esi
lea eax, [esi - 4]
push eax
push dword [esi + 0xc]
push ecx
call fcn.30031b87
test eax, eax
je 0x300323a7
jmp 0x30032430
push edi
jmp 0x300323f6
lea eax, [ebp - 0x18]
push eax
lea eax, [esi - 4]
push eax
push ebx
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x18], 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x300323a7
mov dword [esi - 8], edi
jmp 0x300323a7
Function at 0x3003256e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.30032438
test eax, eax
je 0x300325df
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x300325df
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x30005bcc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x300325d5
cmp dword [ebp - 0x10], 1
je 0x300325d5
and word [esi], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc

Function at 0x300350ad
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x300350e8
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x300350c5
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x30035104
dec esi
je 0x300350fd
dec esi
jne 0x30035109
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x300364a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], al
mov dword [ebx + 0x10], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov word [ebx + 0xc], ax
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], eax
jne 0x300364ef
mov ecx, 0x2000
lea edi, [esi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov word [ebx + 0x2c], ax
mov dword [ebx + 0x30], eax
call fcn.30035f26
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], 0
mov ecx, 0x8000
push 2
mov word [ebx + 0x3c], cx
mov dword [ebx + 0x34], ecx
add eax, ecx
pop edx
movzx edi, byte [eax]
mov esi, dword [ebx + 0x20]
shl esi, 5
xor esi, edi
and esi, 0x7fff
inc eax
dec edx
mov dword [ebx + 0x20], esi
jne 0x30036513
cmp byte [ebp + 0x24], 0
je 0x3003653a
mov edi, ebx
call fcn.30035d88
jmp 0x30036549
xor eax, eax
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x3003653c
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.3003520d
push 0x4b
pop edx
call fcn.3003520d
call fcn.3003624b
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x30036583
mov edi, dword [ebx + 0x14]
mov ecx, 0x2000
lea esi, [edi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x3003e5d2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x3003e5ef
push 0x30006498
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [ebp + 0x14], 0
jne 0x3003e606
push 0x30006498
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x94]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x8c]
mov eax, dword [ebp + 0xc]
add ecx, dword [eax + 0x90]
cmp edx, ecx
jbe 0x3003e635
mov eax, 0x80070057
jmp 0x3003e679
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.3003e52b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x3003e676
cmp dword [ebp + 0x18], 0
je 0x3003e661
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x94]
add edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x94], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x3003e67f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0
jne 0x3003e69c
push 0x30006498
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [ebp + 0x10], 0
jne 0x3003e6b3
push 0x30006498
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov eax, dword [ebp + 0x14]
or eax, dword [ebp + 0x18]
jne 0x3003e6cc
push 0x30006498
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [ebp + 0x1c], 0
jne 0x3003e6e3
push 0x30006498
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x70]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x7c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0x10
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x68]
mov eax, dword [ebp + 0xc]
add ecx, dword [eax + 0x6c]
cmp edx, ecx
ja 0x3003e728
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x74]
mov edx, dword [ebp + 0xc]
add eax, dword [edx + 0x78]
cmp ecx, eax
jbe 0x3003e732
mov eax, 0x80070057
jmp 0x3003e7be
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.3003e52b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x3003e755
mov eax, dword [ebp - 4]
jmp 0x3003e7be
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.3003e52b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x3003e790
mov eax, dword [ebp - 4]
jmp 0x3003e7be
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x70]
add ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x70], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x7c]
add ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x7c], ecx
cmp dword [ebp + 0x20], 0
je 0x3003e7bc
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c