joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30023432
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x30023523
cmp dword [ebp + 8], ebx
je 0x30023523
push 0x106
push 0x10000
call fcn.3005343f
mov edx, eax
xor eax, eax
cmp edx, ebx
mov dword [ebp - 8], edx
je 0x30023525
push edi
push 0x8000
push edx
push dword [ebp + 8]
mov edi, edx
mov ecx, 0x4000
rep stosd dword es:[edi], eax
call fcn.300233e4
test eax, eax
pop edi
je 0x30023517
push esi
push ebx
push ebx
push 4
push dword [ebp + 0x10]
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x300234e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [ebp - 0xc], eax
je 0x300234c5
cmp eax, 0x21
je 0x300234c5
cmp eax, 0x36
jne 0x30023516
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x300234d9
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0x32
jl 0x30023490
jmp 0x30023516
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.3004dd60
add eax, eax
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
pop esi
push dword [ebp - 8]
call fcn.30053354
mov eax, ebx
jmp 0x30023525
xor eax, eax
pop ebx
leave
ret 0xc

Function at 0x3002352a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov dword [ebp - 4], ebx
je 0x30023613
cmp dword [ebp + 8], ebx
je 0x30023613
push 0x106
mov esi, 0x8000
push esi
call fcn.3005343f
mov edx, eax
xor eax, eax
cmp edx, ebx
mov dword [ebp - 8], edx
je 0x30023615
push edi
push esi
push edx
push dword [ebp + 8]
mov edi, edx
mov ecx, 0x2000
rep stosd dword es:[edi], eax
call fcn.30023395
test eax, eax
pop edi
je 0x30023607
push ebx
push ebx
push 4
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x300235d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [ebp - 0xc], eax
je 0x300235b8
cmp eax, 0x21
je 0x300235b8
cmp eax, 0x36
jne 0x30023607
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x300235cc
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0x32
jl 0x30023585
jmp 0x30023607
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.3004dcd9
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call fcn.30053354
mov eax, ebx
jmp 0x30023615
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x30023b1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [section..cdata]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x1c], 0x3a
mov word [ebp - 0x1a], 0x5c
mov word [ebp - 0x18], 0x2f
mov word [ebp - 0x16], 0x3c
mov word [ebp - 0x14], 0x3e
mov word [ebp - 0x12], 0x22
mov word [ebp - 0x10], 0x7c
mov word [ebp - 0xe], 0x2a
mov word [ebp - 0xc], 0x3f
mov word [ebp - 0xa], 0x26
mov word [ebp - 8], 0x2c
mov word [ebp - 6], 0x25
mov dword [ebp - 0x78], 0x300032e0
mov dword [ebp - 0x74], 0x300032d8
mov dword [ebp - 0x70], 0x300032d0
mov dword [ebp - 0x6c], 0x300032c0
mov dword [ebp - 0x68], 0x300032b8
mov dword [ebp - 0x64], 0x300032ac
mov dword [ebp - 0x60], 0x300032a0
mov dword [ebp - 0x5c], 0x30003294
mov dword [ebp - 0x58], 0x30003288
mov dword [ebp - 0x54], 0x3000327c
mov dword [ebp - 0x50], 0x30003270
mov dword [ebp - 0x4c], 0x30003264
mov dword [ebp - 0x48], 0x30003258
mov dword [ebp - 0x44], 0x3000324c
mov dword [ebp - 0x40], 0x30003240
mov dword [ebp - 0x3c], 0x30003234
mov dword [ebp - 0x38], 0x30003228
mov dword [ebp - 0x34], 0x3000321c
mov dword [ebp - 0x30], 0x30003210
mov dword [ebp - 0x2c], 0x30003204
mov dword [ebp - 0x28], 0x300031f8
mov dword [ebp - 0x24], 0x300031ec
mov dword [ebp - 0x20], 0x300031e0
xor ebx, ebx
jmp 0x30023c47
mov ax, word [ecx]
xor edx, edx
cmp ax, word [ebp + edx*2 - 0x1c]
jne 0x30023c2c
push 0x5f
pop eax
inc edx
cmp edx, 0xc
jl 0x30023c22
cmp ax, bx
mov word [ecx], ax
jbe 0x30023c45
cmp ax, 0x20
jae 0x30023c45
mov word [ecx], 0x5f
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x30023c1d
mov esi, dword [ebp + ebx*4 - 0x78]
push esi
call fcn.3004dd60
mov edi, eax
push edi
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.30032962
test eax, eax
jne 0x30023c76
mov di, word [esi + edi*2]
test di, di
je 0x30023c7e
cmp di, 0x2e
je 0x30023c7e
inc ebx
cmp ebx, 0x17
jl 0x30023c4c
jmp 0x30023c83
mov word [esi], 0x58
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.30062195
leave
ret 4

Function at 0x30024687
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x3009b508], 1
mov eax, dword [section..cdata]
mov dword [ebp - 4], eax
jb 0x300246ac
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x30024718
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x30024715
push edi
push dword [ebp + 8]
call fcn.3004dcd9
mov edi, eax
lea eax, [ebp - 0x108]
push eax
call fcn.3004dcd9
lea eax, [edi + eax + 2]
cmp eax, esi
pop edi
ja 0x30024715
push esi
lea eax, [ebp - 0x108]
push eax
push 0x30002958
call fcn.3004f102
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.3004f102
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x30024717
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.30062195
leave
ret 4
Function at 0x300247d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x58], 0x44
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov eax, dword [0x300998a8]
push 0xfa0
mov dword [ebp - 4], ebx
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 8], ebx
je 0x30024852
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [0x3009b4e4]
call edi
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
lea eax, [ebp - 4]
push eax
call fcn.300521be
test eax, eax
je 0x3002489b
push esi
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push dword [0x3009b4e4]
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x300998a8]
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push dword [ebp - 4]
add eax, 0x258
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 4], ebx
mov esi, eax
je 0x30024887
push dword [ebp - 4]
call fcn.300522bc
cmp esi, ebx
je 0x3002489b
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x30024cf3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [section..cdata]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
je 0x30024ea4
test byte [ebp + 0xc], 8
je 0x30024ea4
lea eax, [ebp - 0x118]
push eax
call fcn.3001b745
test eax, eax
je 0x30024ea4
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x118]
push eax
push 0x300035a8
call fcn.3004f102
push esi
lea eax, [ebp - 0x118]
push eax
push 0x300035a0
call fcn.3004f102
push 1
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
je 0x30024ea2
push 0x30003588
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
je 0x30024ea2
push dword [ebp + 8]
sub esi, edi
push ebx
push 0x43a
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x30024ea2
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push edi
mov dword [ebp + 0xc], ebx
call dword [0x300a2000]
push 0x106
push dword [ebp + 0xc]
call fcn.3005343f
cmp eax, ebx
mov dword [ebp - 0x11c], eax
je 0x30024e9b
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push edi
call dword [0x300a2000]
test eax, eax
je 0x30024e90
xor esi, esi
test dword [ebp + 0xc], 0xfffffffc
jbe 0x30024e90
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x11c]
push dword [eax + esi*4]
push edi
call dword [0x300a200c]
test eax, eax
jle 0x30024e4b
push 0x300035a0
lea eax, [ebp - 0x14]
push eax
call fcn.30032880
test eax, eax
jne 0x30024e4b
push 0xc
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x11c]
push dword [eax + esi*4]
push edi
call dword [0x300a2008]
test eax, eax
jne 0x30024e58
mov eax, dword [ebp + 0xc]
inc esi
shr eax, 2
cmp esi, eax
jb 0x30024e02
jmp 0x30024e90
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x120]
add eax, ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push ebx
push eax
push 0x10000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
cmp esi, ebx
je 0x30024e90
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x11c]
call fcn.30053354
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.30062195
leave
ret 8
Function at 0x30025331
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [section..cdata]
mov dword [ebp + 0x9c], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0xac]
call fcn.30032fd4
test eax, eax
je 0x300254bb
push edi
push 0x104
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x78]
call fcn.3004f0aa
lea eax, [ebp - 0x68]
push eax
call fcn.30022ca7
mov edi, eax
cmp byte [edi], 0x5c
jne 0x300254ba
push ebx
lea eax, [ebp - 0x6c]
push eax
push 0x20019
xor ebx, ebx
push ebx
lea eax, [ebp - 0x68]
mov byte [edi], bl
push eax
push dword [ebp - 0x74]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x300254b9
push esi
mov esi, dword [ebp + 0xa8]
mov eax, dword [esi + 0xc]
sub eax, ebx
je 0x3002548a
dec eax
je 0x3002546d
dec eax
je 0x30025454
dec eax
jne 0x300254af
push 1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], ebx
call fcn.30032723
test eax, eax
je 0x300254af
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x70]
push ebx
push ebx
call edi
mov dword [ebp + 0xac], eax
add eax, eax
push 0x106
push eax
mov dword [ebp + 0xa8], eax
call fcn.3005343f
cmp eax, ebx
mov dword [esi + 4], eax
je 0x30025445
push dword [ebp + 0xac]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x70]
push ebx
push ebx
call edi
mov eax, dword [ebp + 0xa8]
mov dword [esi + 8], eax
mov dword [esi], 1
cmp dword [ebp - 0x70], ebx
je 0x300254af
push dword [ebp - 0x70]
call fcn.30053354
jmp 0x300254af
push 3
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x6c]
call fcn.30032723
test eax, eax
je 0x300254af
jmp 0x300254a9
xor ebx, ebx
inc ebx
push ebx
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x6c]
call fcn.30032723
test eax, eax
je 0x300254af
mov dword [esi], ebx
jmp 0x300254af
lea eax, [ebp - 0x7c]
push eax
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x7c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x300254af
mov dword [esi], 1
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp + 0x9c]
call fcn.30062195
add ebp, 0xa0
leave
ret 8
Function at 0x300254d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x30002d3c
call fcn.30032fd4
test eax, eax
jne 0x300254ee
leave
ret
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
xor esi, esi
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x30025517
xor eax, eax
jmp 0x30025612
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x30025548
inc dword [ebp - 0x10]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call fcn.300521be
test eax, eax
jne 0x30025553
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30025510
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
jbe 0x300255f7
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x300255d1
push dword [ebp - 8]
call fcn.3002245b
test eax, eax
je 0x300255c4
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x300255c4
push 3
push 0x300655a0
push 0x3006559c
push 0x300657c0
push dword [ebp - 0x14]
call fcn.30032723
test eax, eax
push dword [ebp - 0x14]
jne 0x300255e7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jb 0x3002555f
jmp 0x300255f7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.300522bc
jmp 0x30025510
mov dword [0x30065598], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.300522bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x300256f4
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [section..cdata]
push ebx
push esi
mov esi, dword [ebp + 0xa0]
imul esi, esi, 0x18
xor ebx, ebx
cmp dword [esi + 0x30065580], ebx
mov dword [ebp + 0x90], eax
je 0x30025738
mov eax, dword [esi + 0x30065584]
cmp eax, dword [ebp + 0xa4]
jne 0x30025738
xor eax, eax
inc eax
jmp 0x30025811
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x9c]
call fcn.3004f0aa
mov eax, dword [esi + 0x30065590]
cmp eax, ebx
je 0x3002577b
cmp byte [eax], bl
je 0x3002577b
push edi
lea eax, [ebp - 0x74]
push eax
push 0x30002958
call fcn.3004f102
push edi
lea eax, [ebp - 0x74]
push eax
push dword [esi + 0x30065590]
call fcn.3004f102
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.30032fd4
test eax, eax
jne 0x30025794
xor eax, eax
jmp 0x30025810
push dword [ebp - 0x78]
call fcn.30022ca7
mov edi, eax
cmp byte [edi], 0x5c
jne 0x30025790
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x20006
push ebx
push ebx
mov byte [edi], bl
push ebx
push dword [ebp - 0x78]
inc edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x30025790
mov eax, dword [esi + 0x30065594]
cmp eax, ebx
je 0x300257d2
cmp byte [eax], bl
jne 0x300257d4
mov eax, edi
push 4
pop edi
push edi
lea ecx, [ebp + 0xa4]
push ecx
push edi
push ebx
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x30025790
mov eax, dword [ebp + 0xa4]
mov dword [esi + 0x30065584], eax
xor eax, eax
inc eax
mov dword [esi + 0x30065588], edi
mov dword [esi + 0x30065580], eax
mov dword [esi + 0x3006558c], ebx
pop edi
mov ecx, dword [ebp + 0x90]
pop esi
pop ebx
call fcn.30062195
add ebp, 0x94
leave
ret 0xc

Function at 0x30025876
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7e4]
sub esp, 0x864
mov eax, dword [section..cdata]
push esi
mov esi, dword [ebp + 0x7ec]
test esi, esi
mov dword [ebp + 0x7e0], eax
je 0x3002593c
call fcn.30022b36
test eax, eax
je 0x300258c1
push 0x300035ec
call fcn.30022bd0
push esi
call fcn.30022bd0
push 0x300029a0
call fcn.30022bd0
cmp dword [0x3009b4cc], 0
jne 0x300258d4
push esi
call fcn.30021d46
test eax, eax
je 0x300258de
push esi
call fcn.30021df8
test eax, eax
jne 0x3002593c
push 0x824
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.3004f0aa
cmp dword [ebp + 0x7f0], 0
je 0x30025901
lea eax, [ebp - 0x44]
push eax
call fcn.30021f58
jmp 0x3002593c
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x64], 0xa
mov dword [ebp - 0x7c], 0x100
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
jne 0x3002593c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x7e0]
pop esi
call fcn.30062195
add ebp, 0x7e4
leave
ret 8
Function at 0x30025c31
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x30025cc8
push edi
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x30025cc7
push edi
call fcn.30022ccc
cmp eax, edi
je 0x30025cc7
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
sub eax, edi
sar eax, 1
push eax
push edi
push esi
push dword [0x3009b4e4]
mov dword [ebp - 8], eax
call ebx
mov esi, eax
inc esi
push esi
lea eax, [ebp - 4]
push eax
call fcn.300521be
test eax, eax
je 0x30025cc6
mov edi, dword [ebp - 4]
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
push eax
push dword [0x3009b4e4]
call ebx
test eax, eax
je 0x30025cbe
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp - 4]
call fcn.300522bc
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x30025dc1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x30025dd4
xor eax, eax
jmp 0x30025dd7
and eax, 0x10
ret 4

Function at 0x30025eae
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x30025ed4
xor eax, eax
jmp 0x30025f39
push ebx
push 0x106
push esi
call fcn.3005343f
mov ebx, eax
cmp ebx, edi
jne 0x30025eea
xor eax, eax
jmp 0x30025f38
push ebx
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x30025f30
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x30002958
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x30025f30
mov esi, dword [ebp - 0xc]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.3002242e
test eax, eax
je 0x30025f30
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0x14]
xor edi, edi
inc edi
and eax, edi
mov dword [ecx], eax
push ebx
call fcn.30053354
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x300263e1
Capabilities:
Get common file path
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [section..cdata]
push ebx
push esi
push edi
mov dword [ebp + 0x8c], eax
push 0x104
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
je 0x30026421
lea eax, [ebp - 0x78]
push eax
push 0x300037bc
call edi
push 0x300037ac
call fcn.30024687
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x7c], eax
je 0x300264bb
push 0x30003798
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x300264b2
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x26
push ebx
call esi
test eax, eax
jne 0x30026464
lea eax, [ebp - 0x78]
push eax
push 0x3000378c
call edi
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x2b
push ebx
call esi
test eax, eax
jne 0x3002647e
lea eax, [ebp - 0x78]
push eax
push 0x30003780
call edi
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x1a
push ebx
call esi
test eax, eax
jne 0x30026498
lea eax, [ebp - 0x78]
push eax
push 0x30003778
call edi
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 5
push ebx
call esi
test eax, eax
jne 0x300264b2
lea eax, [ebp - 0x78]
push eax
push 0x3000376c
call edi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x80]
push eax
push 0x20019
push ebx
push 0x30003738
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3002652f
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x30003730
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x30026526
lea eax, [ebp - 0x78]
lea esi, [ebp - 0x78]
push eax
dec esi
call fcn.3004dcd9
cmp byte [eax + esi], 0x5c
jne 0x3002651b
lea eax, [ebp - 0x78]
push eax
call fcn.3004dcd9
mov byte [eax + esi], bl
lea eax, [ebp - 0x78]
push eax
push 0x30003724
call edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
pop ebx
call fcn.30062195
add ebp, 0x90
leave
ret
Function at 0x30026545
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x30026556
xor eax, eax
jmp 0x300265c3
cmp dword [ebp + 0x10], esi
push ebx
je 0x3002658f
push 0x106
push dword [ebp + 0x10]
call fcn.3005343f
mov ebx, eax
cmp ebx, esi
jne 0x30026573
xor eax, eax
jmp 0x300265c2
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, ecx
push edi
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
pop edi
jmp 0x30026592
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x300265b0
push ebx
call dword [ebp + 8]
jmp 0x300265bf
lea eax, [ebp - 4]
push eax
push dword [0x30096944]
call fcn.30054d59
mov eax, dword [ebp - 4]
pop ebx
pop esi
leave
ret 0xc