joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dfc8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4321c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004138fc
mov dword [ebp - 0x14], eax
cmp dword [0x434c90], esi
jne 0x41e0bb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41e048
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41e19b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41e19b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41e19b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x434c90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x434c94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x434c98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x434ca0], eax
test eax, eax
je 0x41e0b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x434c9c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41e0e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41e0d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41e0f5
push 4
pop eax
jmp 0x41e19d
cmp dword [ebp - 0x14], esi
je 0x41e0f5
push dword [0x434c90]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41e0da
mov eax, dword [0x434c9c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41e153
cmp dword [0x434ca0], edi
je 0x41e153
push eax
call ebx
push dword [0x434ca0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41e153
test eax, eax
je 0x41e153
call ecx
test eax, eax
je 0x41e148
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41e148
test byte [ebp - 8], 1
jne 0x41e153
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41e183
mov eax, dword [0x434c94]
cmp eax, edi
je 0x41e180
push eax
call ebx
test eax, eax
je 0x41e180
call eax
mov esi, eax
test esi, esi
je 0x41e180
mov eax, dword [0x434c98]
cmp eax, edi
je 0x41e180
push eax
call ebx
test eax, eax
je 0x41e180
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x434c90]
call ebx
test eax, eax
je 0x41e19b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41e19d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fd44
mov esp, ebp
pop ebp
ret
Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.00408055
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
push dword [esp + 0x14]
pop eax
call fcn.00407ff0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403370
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
call fcn.0040ac40
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
mov dword [esp + 0xc], 2
jmp 0x403382
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403382
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e47c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e3e0], eax
mov eax, 1
jmp 0x4033b5
push dword [esp + 4]
call fcn.0040aca0
add esp, 0xc
pop ebx
ret 4

Function at 0x4033c5
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4033cc
mov edx, dword [esp + 0x34]
lea ecx, [esp]
jmp loc.0041169b

Function at 0x4037f1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.00404060
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x403842
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_LoadResource
mov dword [0x40e3e4], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x40e3f8], eax
mov eax, dword [esp + 4]
jmp 0x40384a
push dword [esp]
call fcn.0040aca0
add esp, 8
ret 8
Function at 0x40c31d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418538]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004097a3
mov dword [ebp - 0x14], eax
cmp dword [0x457fd8], esi
jne 0x40c410
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c39d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c4f0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c4f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c4f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x457fd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x457fdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x457fe0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457fe8], eax
test eax, eax
je 0x40c40d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457fe4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c435
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c428
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c44a
push 4
pop eax
jmp 0x40c4f2
cmp dword [ebp - 0x14], esi
je 0x40c44a
push dword [0x457fd8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c42f
mov eax, dword [0x457fe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c4a8
cmp dword [0x457fe8], edi
je 0x40c4a8
push eax
call ebx
push dword [0x457fe8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c4a8
test eax, eax
je 0x40c4a8
call ecx
test eax, eax
je 0x40c49d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c49d
test byte [ebp - 8], 1
jne 0x40c4a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c4d8
mov eax, dword [0x457fdc]
cmp eax, edi
je 0x40c4d5
push eax
call ebx
test eax, eax
je 0x40c4d5
call eax
mov esi, eax
test esi, esi
je 0x40c4d5
mov eax, dword [0x457fe0]
cmp eax, edi
je 0x40c4d5
push eax
call ebx
test eax, eax
je 0x40c4d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x457fd8]
call ebx
test eax, eax
je 0x40c4f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c4f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042ed
mov esp, ebp
pop ebp
ret
Function at 0x401377
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
cmp dword [0x1a01098], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x4013ad
push 0
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4192f8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4192fc]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x28], eax
call fcn.0040136d
mov ecx, dword [0x419300]
mov eax, dword [0x419304]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x1a01098], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1a01094]
cmove eax, edx
xor edx, edx
cmp dword [0x1a01098], 0x3eb
mov dword [0x1a01094], eax
mov eax, dword [0x1a00a84]
cmove eax, edx
add ecx, ebx
mov dword [0x1a00a84], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x1a01098]
xor eax, edx
mov dword [0x1a01090], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x4014e1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1a01098]
sub edi, eax
cmp ecx, 0xc
jne 0x4014ef
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.00401374
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x40153b
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x4013eb
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e592
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a8b7
mov dword [ebp - 0x14], eax
cmp dword [0x43aea0], esi
jne 0x40e685
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e612
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e765
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e765
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e765
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43aea0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43aea4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43aea8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43aeb0], eax
test eax, eax
je 0x40e682
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43aeac], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e6aa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e69d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e6bf
push 4
pop eax
jmp 0x40e767
cmp dword [ebp - 0x14], esi
je 0x40e6bf
push dword [0x43aea0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e6a4
mov eax, dword [0x43aeac]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e71d
cmp dword [0x43aeb0], edi
je 0x40e71d
push eax
call ebx
push dword [0x43aeb0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e71d
test eax, eax
je 0x40e71d
call ecx
test eax, eax
je 0x40e712
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e712
test byte [ebp - 8], 1
jne 0x40e71d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e74d
mov eax, dword [0x43aea4]
cmp eax, edi
je 0x40e74a
push eax
call ebx
test eax, eax
je 0x40e74a
call eax
mov esi, eax
test esi, esi
je 0x40e74a
mov eax, dword [0x43aea8]
cmp eax, edi
je 0x40e74a
push eax
call ebx
test eax, eax
je 0x40e74a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43aea0]
call ebx
test eax, eax
je 0x40e765
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e767
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403d20
mov esp, ebp
pop ebp
ret
Function at 0x30002772
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3003a2ac]
jne 0x300e7d64
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30118950], eax
mov dword [0x3011894c], ecx
mov dword [0x30118948], edx
mov dword [0x30118944], ebx
mov dword [0x30118940], esi
mov dword [0x3011893c], edi
mov word [0x30118968], ss
mov word [0x3011895c], cs
mov word [0x30118938], ds
mov word [0x30118934], es
mov word [0x30118930], fs
mov word [0x3011892c], gs
pushfd
pop dword [0x30118960]
mov eax, dword [ebp]
mov dword [0x30118954], eax
mov eax, dword [ebp + 4]
mov dword [0x30118958], eax
lea eax, [ebp + 8]
mov dword [0x30118964], eax
mov eax, dword [ebp - 0x320]
mov dword [0x301188a0], 0x10001
mov eax, dword [0x30118958]
mov dword [0x30118854], eax
mov dword [0x30118848], 0xc0000409
mov dword [0x3011884c], 1
mov eax, dword [0x3003a2ac]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3010bc04]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x30118898], eax
push 1
call sub.MSVCR90.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x300e7e64
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x30118898], 0
jne 0x300e7e50
push 1
call sub.MSVCR90.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x300027c2
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x3003a2ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x214], 1
call sub.MSVCR90.dll_memset
mov eax, 0x3010eb94
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov ecx, eax
cmp dword [ecx], 0
jne 0x3005b858
imul esi, esi, 0x14
add esi, eax
je 0x30002932
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3000294c
cmp dword [ebp - 0x214], 1
jne 0x3000294c
xor ebx, ebx
cmp word [ebp - 0x20c], bx
je 0x3000292a
cmp dword [ebp - 0x210], ebx
je 0x3000292a
shr dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0x104
jae 0x30002943
mov ecx, dword [ebp - 0x210]
mov word [ebp + ecx*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, ebx
je 0x3000292a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3000298c
push eax
call edi
cmp eax, ebx
je 0x3005b86d
call eax
mov dword [esi + 4], eax
cmp eax, 1
je 0x3005b875
cmp eax, 2
je 0x3005b894
cmp eax, 3
jne 0x30002909
push 0x3000297c
push dword [esi]
call edi
push 0x30002964
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x30002950
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], ebx
je 0x3000292a
cmp dword [esi + 0x10], ebx
je 0x3000292a
cmp dword [esi + 0xc], ebx
je 0x3000292a
push dword [0x3010ebbc]
push esi
call fcn.300029ac
test eax, eax
jl 0x3000292a
xor esi, esi
cmp esi, ebx
jne 0x3005b8a4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.30002772
leave
ret 0xc
mov word [ebp - 6], ax
jmp 0x300028a0
xor ebx, ebx
jmp 0x3000292a
add ecx, 0x14
inc esi
cmp ecx, 0x3010ebbc
jge 0x30002932
jmp 0x30002819
mov eax, dword [ebp + 0x10]
jmp 0x300028cb
push 0x3005b8fc
push dword [esi]
call edi
push 0x3005b8e8
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x3005b8d8
jmp 0x300028ff
push 0x3005b8fc
push dword [esi]
call edi
push 0x3005b8c4
jmp 0x3005b883
mov eax, dword [esi]
cmp eax, ebx
je 0x3005b8b1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
jmp 0x30002932
Function at 0x30002aee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x3003a2ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor esi, esi
push esi
push 0x30002bd0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], 0x20a
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x30002bbd
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x30002c24
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 0x214], esi
je 0x30002b74
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x30002bbd
mov eax, dword [ebp - 0x218]
cmp eax, 2
jb 0x30002bbd
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x212], cx
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0x30002c48
call fcn.30002c8e
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x3005b56c
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.30002772
leave
ret
push 0x30060a9c
call fcn.300d68df
mov ebx, eax
jmp 0x30002bbd
Function at 0x30005354
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
imul esi, esi, 0x24
push edi
xor edi, edi
add esi, 0x3010b7c8
cmp dword [ebp + 8], 1
jne 0x3004f074
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x300570b2
and dword [eax], edi
cmp dword [esi + 4], edi
je 0x30005396
mov dword [eax], esi
test edi, edi
jl 0x3004f083
mov eax, edi
pop edi
pop esi
leave
ret 8
call dword [sym.imp.MSO.dll_Ordinal_6160]
push 0x8007
push 0
push 0
mov dword [ebp - 4], eax
push 8
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.MSO.dll_Ordinal_1746]
mov dword [esi + 4], eax
test eax, eax
je 0x300570bc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30037ea0
push eax
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x300570bc
push 0x30037e90
push dword [esi + 4]
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x300570bc
push 0x30005508
push dword [esi + 4]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x300570bc
cmp dword [ebp + 8], 1
jne 0x3000545e
push 0x300054f4
push dword [esi + 4]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x300570bc
push 0x300054e0
push dword [esi + 4]
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x300570bc
push 0x300054c4
push dword [esi + 4]
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x300570bc
push 0x300054a8
push dword [esi + 4]
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x300570bc
push dword [ebp + 8]
mov ecx, 0x3010e928
push fcn.3001fa86
call fcn.30005533
push 0x3000549c
push dword [esi + 4]
call edi
test eax, eax
je 0x300570bc
push dword [0x3010c064]
call eax
mov edi, eax
test edi, edi
jl 0x3004f083
mov eax, dword [ebp + 0xc]
jmp 0x30005384
cmp dword [ebp + 8], 2
je 0x30005372
jmp 0x300570b2
push dword [ebp + 8]
call fcn.3001fa86
jmp 0x3000538e
mov edi, 0x80070057
jmp 0x3004f083
mov edi, 0x80004005
jmp 0x3004f083