joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30022fb2
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x8ec]
sub esp, 0x96c
mov eax, dword [section..cdata]
push ebx
push edi
mov dword [ebp + 0x8e8], eax
push 0xf
xor eax, eax
cmp dword [ebp + 0x8f4], 0
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x7e4]
mov dword [ebp - 0x44], 0x824
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0x104
jne 0x30023005
xor eax, eax
jmp 0x30023112
push esi
mov esi, 0x10000000
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0x8f4]
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
je 0x3002310f
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x3002310f
cmp dword [ebp - 0x74], 3
je 0x30023052
cmp dword [ebp - 0x74], 4
jne 0x3002310f
push dword [ebp - 0x70]
call fcn.3004ead5
mov esi, 0x30002d70
push esi
mov ebx, eax
call fcn.3004ead5
push eax
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.30032d5d
test eax, eax
je 0x30023090
mov esi, 0x30002d78
push esi
call fcn.3004ead5
push eax
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.30032d5d
test eax, eax
jne 0x3002310f
push esi
call fcn.3004ead5
lea eax, [ebp + eax - 0x40]
jmp 0x300230a1
test cl, cl
je 0x3002310f
inc eax
mov cl, byte [eax]
cmp cl, 0x2f
jne 0x3002309c
test cl, cl
je 0x3002310f
mov eax, dword [ebp - 0x70]
mov edi, 0x30003170
push edi
lea esi, [ebx + eax]
call fcn.3004ead5
cmp ebx, eax
jl 0x300230d1
push eax
mov ecx, esi
push edi
sub ecx, eax
push ecx
call fcn.30032d5d
test eax, eax
je 0x3002310a
mov edi, 0x30003164
push edi
call fcn.3004ead5
cmp ebx, eax
jl 0x300230ee
push eax
push edi
sub esi, eax
push esi
call fcn.30032d5d
test eax, eax
je 0x3002310a
mov esi, 0x30003154
push esi
call fcn.3004ead5
cmp ebx, eax
jne 0x3002310f
push esi
push dword [ebp - 0x70]
call fcn.30032b98
test eax, eax
jne 0x3002310f
xor eax, eax
inc eax
jmp 0x30023111
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x8e8]
pop edi
pop ebx
call fcn.30063125
add ebp, 0x8ec
leave
ret 4
Function at 0x3002357b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x3002366c
cmp dword [ebp + 8], ebx
je 0x3002366c
push 0x106
push 0x10000
call fcn.3005424c
mov edx, eax
xor eax, eax
cmp edx, ebx
mov dword [ebp - 8], edx
je 0x3002366e
push edi
push 0x8000
push edx
push dword [ebp + 8]
mov edi, edx
mov ecx, 0x4000
rep stosd dword es:[edi], eax
call fcn.30023528
test eax, eax
pop edi
je 0x30023660
push esi
push ebx
push ebx
push 4
push dword [ebp + 0x10]
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x3002362a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [ebp - 0xc], eax
je 0x3002360e
cmp eax, 0x21
je 0x3002360e
cmp eax, 0x36
jne 0x3002365f
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x30023622
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0x32
jl 0x300235d9
jmp 0x3002365f
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.3004eb5c
add eax, eax
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
pop esi
push dword [ebp - 8]
call fcn.30054161
mov eax, ebx
jmp 0x3002366e
xor eax, eax
pop ebx
leave
ret 0xc

Function at 0x30023673
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov dword [ebp - 4], ebx
je 0x3002375c
cmp dword [ebp + 8], ebx
je 0x3002375c
push 0x106
mov esi, 0x8000
push esi
call fcn.3005424c
mov edx, eax
xor eax, eax
cmp edx, ebx
mov dword [ebp - 8], edx
je 0x3002375e
push edi
push esi
push edx
push dword [ebp + 8]
mov edi, edx
mov ecx, 0x2000
rep stosd dword es:[edi], eax
call fcn.300234d4
test eax, eax
pop edi
je 0x30023750
push ebx
push ebx
push 4
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x3002371d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [ebp - 0xc], eax
je 0x30023701
cmp eax, 0x21
je 0x30023701
cmp eax, 0x36
jne 0x30023750
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x30023715
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0x32
jl 0x300236ce
jmp 0x30023750
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.3004ead5
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call fcn.30054161
mov eax, ebx
jmp 0x3002375e
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x30023c72
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [section..cdata]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x1c], 0x3a
mov word [ebp - 0x1a], 0x5c
mov word [ebp - 0x18], 0x2f
mov word [ebp - 0x16], 0x3c
mov word [ebp - 0x14], 0x3e
mov word [ebp - 0x12], 0x22
mov word [ebp - 0x10], 0x7c
mov word [ebp - 0xe], 0x2a
mov word [ebp - 0xc], 0x3f
mov word [ebp - 0xa], 0x26
mov word [ebp - 8], 0x2c
mov word [ebp - 6], 0x25
mov dword [ebp - 0x78], 0x300032e0
mov dword [ebp - 0x74], 0x300032d8
mov dword [ebp - 0x70], 0x300032d0
mov dword [ebp - 0x6c], 0x300032c0
mov dword [ebp - 0x68], 0x300032b8
mov dword [ebp - 0x64], 0x300032ac
mov dword [ebp - 0x60], 0x300032a0
mov dword [ebp - 0x5c], 0x30003294
mov dword [ebp - 0x58], 0x30003288
mov dword [ebp - 0x54], 0x3000327c
mov dword [ebp - 0x50], 0x30003270
mov dword [ebp - 0x4c], 0x30003264
mov dword [ebp - 0x48], 0x30003258
mov dword [ebp - 0x44], 0x3000324c
mov dword [ebp - 0x40], 0x30003240
mov dword [ebp - 0x3c], 0x30003234
mov dword [ebp - 0x38], 0x30003228
mov dword [ebp - 0x34], 0x3000321c
mov dword [ebp - 0x30], 0x30003210
mov dword [ebp - 0x2c], 0x30003204
mov dword [ebp - 0x28], 0x300031f8
mov dword [ebp - 0x24], 0x300031ec
mov dword [ebp - 0x20], 0x300031e0
xor ebx, ebx
jmp 0x30023d9d
mov ax, word [ecx]
xor edx, edx
cmp ax, word [ebp + edx*2 - 0x1c]
jne 0x30023d82
push 0x5f
pop eax
inc edx
cmp edx, 0xc
jl 0x30023d78
cmp ax, bx
mov word [ecx], ax
jbe 0x30023d9b
cmp ax, 0x20
jae 0x30023d9b
mov word [ecx], 0x5f
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x30023d73
mov esi, dword [ebp + ebx*4 - 0x78]
push esi
call fcn.3004eb5c
mov edi, eax
push edi
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.30032c7a
test eax, eax
jne 0x30023dcc
mov di, word [esi + edi*2]
test di, di
je 0x30023dd4
cmp di, 0x2e
je 0x30023dd4
inc ebx
cmp ebx, 0x17
jl 0x30023da2
jmp 0x30023dd9
mov word [esi], 0x58
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.30063125
leave
ret 4

Function at 0x300247dd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x3009c3f0], 1
mov eax, dword [section..cdata]
mov dword [ebp - 4], eax
jb 0x30024802
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x3002486e
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x3002486b
push edi
push dword [ebp + 8]
call fcn.3004ead5
mov edi, eax
lea eax, [ebp - 0x108]
push eax
call fcn.3004ead5
lea eax, [edi + eax + 2]
cmp eax, esi
pop edi
ja 0x3002486b
push esi
lea eax, [ebp - 0x108]
push eax
push 0x30002958
call fcn.3004ff05
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.3004ff05
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x3002486d
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.30063125
leave
ret 4
Function at 0x3002492a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x58], 0x44
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [0x3009a790]
push 0xfa0
mov dword [ebp - 4], ebx
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 8], ebx
je 0x300249a8
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [0x3009c3cc]
call edi
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
lea eax, [ebp - 4]
push eax
call fcn.30052fce
test eax, eax
je 0x300249f1
push esi
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [0x3009c3cc]
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x3009a790]
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push dword [ebp - 4]
add eax, 0x258
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 4], ebx
mov esi, eax
je 0x300249dd
push dword [ebp - 4]
call fcn.300530c9
cmp esi, ebx
je 0x300249f1
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x30024e49
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [section..cdata]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
je 0x30024ffa
test byte [ebp + 0xc], 8
je 0x30024ffa
lea eax, [ebp - 0x118]
push eax
call fcn.3001b85c
test eax, eax
je 0x30024ffa
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x118]
push eax
push 0x300035a8
call fcn.3004ff05
push esi
lea eax, [ebp - 0x118]
push eax
push 0x300035a0
call fcn.3004ff05
push 1
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
je 0x30024ff8
push 0x30003588
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
je 0x30024ff8
push dword [ebp + 8]
sub esi, edi
push ebx
push 0x43a
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x30024ff8
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push edi
mov dword [ebp + 0xc], ebx
call dword [0x300a2ee8]
push 0x106
push dword [ebp + 0xc]
call fcn.3005424c
cmp eax, ebx
mov dword [ebp - 0x11c], eax
je 0x30024ff1
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push edi
call dword [0x300a2ee8]
test eax, eax
je 0x30024fe6
xor esi, esi
test dword [ebp + 0xc], 0xfffffffc
jbe 0x30024fe6
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x11c]
push dword [eax + esi*4]
push edi
call dword [0x300a2ef4]
test eax, eax
jle 0x30024fa1
push 0x300035a0
lea eax, [ebp - 0x14]
push eax
call fcn.30032b98
test eax, eax
jne 0x30024fa1
push 0xc
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x11c]
push dword [eax + esi*4]
push edi
call dword [0x300a2ef0]
test eax, eax
jne 0x30024fae
mov eax, dword [ebp + 0xc]
inc esi
shr eax, 2
cmp esi, eax
jb 0x30024f58
jmp 0x30024fe6
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x120]
add eax, ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push ebx
push eax
push 0x10000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
cmp esi, ebx
je 0x30024fe6
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x11c]
call fcn.30054161
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.30063125
leave
ret 8
Function at 0x300254e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [section..cdata]
mov dword [ebp + 0x9c], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0xac]
call fcn.300332ec
test eax, eax
je 0x3002566d
push edi
push 0x104
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x78]
call fcn.3004feaa
lea eax, [ebp - 0x68]
push eax
call fcn.30022de6
mov edi, eax
cmp byte [edi], 0x5c
jne 0x3002566c
push ebx
lea eax, [ebp - 0x6c]
push eax
push 0x20019
xor ebx, ebx
push ebx
lea eax, [ebp - 0x68]
mov byte [edi], bl
push eax
push dword [ebp - 0x74]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3002566b
push esi
mov esi, dword [ebp + 0xa8]
mov eax, dword [esi + 0xc]
sub eax, ebx
je 0x3002563c
dec eax
je 0x3002561f
dec eax
je 0x30025606
dec eax
jne 0x30025661
push 1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], ebx
call fcn.30032a3b
test eax, eax
je 0x30025661
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x70]
push ebx
push ebx
call edi
mov dword [ebp + 0xac], eax
add eax, eax
push 0x106
push eax
mov dword [ebp + 0xa8], eax
call fcn.3005424c
cmp eax, ebx
mov dword [esi + 4], eax
je 0x300255f7
push dword [ebp + 0xac]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x70]
push ebx
push ebx
call edi
mov eax, dword [ebp + 0xa8]
mov dword [esi + 8], eax
mov dword [esi], 1
cmp dword [ebp - 0x70], ebx
je 0x30025661
push dword [ebp - 0x70]
call fcn.30054161
jmp 0x30025661
push 3
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x6c]
call fcn.30032a3b
test eax, eax
je 0x30025661
jmp 0x3002565b
xor ebx, ebx
inc ebx
push ebx
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x6c]
call fcn.30032a3b
test eax, eax
je 0x30025661
mov dword [esi], ebx
jmp 0x30025661
lea eax, [ebp - 0x7c]
push eax
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x7c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x30025661
mov dword [esi], 1
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp + 0x9c]
call fcn.30063125
add ebp, 0xa0
leave
ret 8
Function at 0x30025682
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x30002d3c
call fcn.300332ec
test eax, eax
jne 0x300256a0
leave
ret
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
xor esi, esi
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x300256c9
xor eax, eax
jmp 0x300257c4
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x300256fa
inc dword [ebp - 0x10]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call fcn.30052fce
test eax, eax
jne 0x30025705
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x300256c2
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
jbe 0x300257a9
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x30025783
push dword [ebp - 8]
call fcn.3002258e
test eax, eax
je 0x30025776
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x30025776
push 3
push 0x300665a0
push 0x3006659c
push 0x300667c0
push dword [ebp - 0x14]
call fcn.30032a3b
test eax, eax
push dword [ebp - 0x14]
jne 0x30025799
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jb 0x30025711
jmp 0x300257a9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.300530c9
jmp 0x300256c2
mov dword [0x30066598], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.300530c9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x300258a6
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [section..cdata]
push ebx
push esi
mov esi, dword [ebp + 0xa0]
imul esi, esi, 0x18
xor ebx, ebx
cmp dword [esi + 0x30066580], ebx
mov dword [ebp + 0x90], eax
je 0x300258ea
mov eax, dword [esi + 0x30066584]
cmp eax, dword [ebp + 0xa4]
jne 0x300258ea
xor eax, eax
inc eax
jmp 0x300259c3
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x9c]
call fcn.3004feaa
mov eax, dword [esi + 0x30066590]
cmp eax, ebx
je 0x3002592d
cmp byte [eax], bl
je 0x3002592d
push edi
lea eax, [ebp - 0x74]
push eax
push 0x30002958
call fcn.3004ff05
push edi
lea eax, [ebp - 0x74]
push eax
push dword [esi + 0x30066590]
call fcn.3004ff05
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.300332ec
test eax, eax
jne 0x30025946
xor eax, eax
jmp 0x300259c2
push dword [ebp - 0x78]
call fcn.30022de6
mov edi, eax
cmp byte [edi], 0x5c
jne 0x30025942
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x20006
push ebx
push ebx
mov byte [edi], bl
push ebx
push dword [ebp - 0x78]
inc edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x30025942
mov eax, dword [esi + 0x30066594]
cmp eax, ebx
je 0x30025984
cmp byte [eax], bl
jne 0x30025986
mov eax, edi
push 4
pop edi
push edi
lea ecx, [ebp + 0xa4]
push ecx
push edi
push ebx
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x30025942
mov eax, dword [ebp + 0xa4]
mov dword [esi + 0x30066584], eax
xor eax, eax
inc eax
mov dword [esi + 0x30066588], edi
mov dword [esi + 0x30066580], eax
mov dword [esi + 0x3006658c], ebx
pop edi
mov ecx, dword [ebp + 0x90]
pop esi
pop ebx
call fcn.30063125
add ebp, 0x94
leave
ret 0xc

Function at 0x30025a28
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7e4]
sub esp, 0x864
mov eax, dword [section..cdata]
push esi
mov esi, dword [ebp + 0x7ec]
test esi, esi
mov dword [ebp + 0x7e0], eax
je 0x30025aee
call fcn.30022c75
test eax, eax
je 0x30025a73
push 0x300035ec
call fcn.30022d0f
push esi
call fcn.30022d0f
push 0x300029a0
call fcn.30022d0f
cmp dword [0x3009c3b4], 0
jne 0x30025a86
push esi
call fcn.30021e6e
test eax, eax
je 0x30025a90
push esi
call fcn.30021f20
test eax, eax
jne 0x30025aee
push 0x824
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.3004feaa
cmp dword [ebp + 0x7f0], 0
je 0x30025ab3
lea eax, [ebp - 0x44]
push eax
call fcn.30022080
jmp 0x30025aee
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x64], 0xa
mov dword [ebp - 0x7c], 0x100
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
jne 0x30025aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x7e0]
pop esi
call fcn.30063125
add ebp, 0x7e4
leave
ret 8
Function at 0x30025de3
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x30025e7a
push edi
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x30025e79
push edi
call fcn.30022e0b
cmp eax, edi
je 0x30025e79
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
sub eax, edi
sar eax, 1
push eax
push edi
push esi
push dword [0x3009c3cc]
mov dword [ebp - 8], eax
call ebx
mov esi, eax
inc esi
push esi
lea eax, [ebp - 4]
push eax
call fcn.30052fce
test eax, eax
je 0x30025e78
mov edi, dword [ebp - 4]
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
push eax
push dword [0x3009c3cc]
call ebx
test eax, eax
je 0x30025e70
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp - 4]
call fcn.300530c9
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x30025f73
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x30025f86
xor eax, eax
jmp 0x30025f89
and eax, 0x10
ret 4

Function at 0x30026060
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x30026086
xor eax, eax
jmp 0x300260eb
push ebx
push 0x106
push esi
call fcn.3005424c
mov ebx, eax
cmp ebx, edi
jne 0x3002609c
xor eax, eax
jmp 0x300260ea
push ebx
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x300260e2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x30002958
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x300260e2
mov esi, dword [ebp - 0xc]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.30022556
test eax, eax
je 0x300260e2
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0x14]
xor edi, edi
inc edi
and eax, edi
mov dword [ecx], eax
push ebx
call fcn.30054161
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 0x10