joyce8/EMBER2024-capa huggingface dataset:
Function at 0x132bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x132bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x132bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x132bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x132bd94
push eax
push esi
call fcn.0132e20b
add esp, 8
pop esi
ret 0x10

Function at 0x132bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x132be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x132be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x1344320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0132ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x132bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x132be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x132bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x132beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x1344320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0132ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x132beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x132be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x132c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x132c131
push esi
call fcn.0132f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0131e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x132c131
push 0
push ebp
call fcn.0131e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0131e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x132c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0131e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x132c121
push 0x1344918
push edi
call fcn.0132d3f0
push eax
push ebx
push esi
call fcn.0132bf60
push 0x13448f8
push edi
call fcn.0132d3f0
push eax
push ebx
push esi
call fcn.0132bf60
push 0x13448d8
push edi
call fcn.0132d3f0
push eax
push ebx
push esi
call fcn.0132bf60
push 0x13448c0
push edi
call fcn.0132d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0132bf60
push 0x13448a0
push edi
call fcn.0132d3f0
push eax
push ebx
push esi
call fcn.0132bf60
push 0x1344888
push edi
call fcn.0132d3f0
push eax
push ebx
push esi
call fcn.0132bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x132d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0132d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0132d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0132d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0132d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x132dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x132dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x133f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x132dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x132dc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x3000db26
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3000db3e
test al, 0x10
jne 0x3000db3e
xor eax, eax
inc eax
jmp 0x3000db40
xor eax, eax
ret 4

Function at 0x3000dbcc
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push 0x10
pop ecx
push 7
mov esi, 0x300015c8
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x300015a4
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, 0x104
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 8]
push eax
mov ecx, esi
mov dword [ebp - 0x6c], eax
call fcn.3000cd95
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x3000dc24
push 0x30001584
call fcn.3000fdf9
pop ecx
jmp 0x3000dcd1
lea eax, [ebp - 0x68]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x3000dc56
lea eax, [ebp - 0x6c]
push eax
push dword [esi]
lea eax, [ebp - 0x24]
push ebx
push ebx
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x68], ebx
je 0x3000dc64
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x3000dca8
push 0x30001530
call fcn.3000ff32
pop ecx
push dword [ebp - 0x6c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [esi]
push 0x30001420
mov ecx, esi
mov word [eax + 4], bx
call fcn.3000cf63
mov edi, eax
cmp edi, ebx
je 0x3000dca8
push 0x300014fc
jmp 0x3000dc19
mov ecx, esi
call fcn.3000cfd4
mov edi, eax
cmp edi, ebx
je 0x3000dcbf
push 0x300014d8
jmp 0x3000dc19
push dword [esi + 4]
push dword [esi]
push 0x30001490
call fcn.3000ff32
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 4
Function at 0x3000dfb9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x30034be8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], edi
xor esi, esi
call ebx
test eax, eax
je 0x3000e06d
cmp word [edi], 0x22
jne 0x3000e006
push edi
call ebx
mov esi, eax
dec esi
cmp word [edi + esi*2], 0x22
jne 0x3000e001
and word [edi + esi*2], 0
lea eax, [edi + 2]
jmp 0x3000e00c
mov eax, dword [ebp - 0x214]
mov ebx, 0x105
push ebx
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
mov dword [ebp + 8], eax
jbe 0x3000e052
cmp eax, ebx
ja 0x3000e052
cmp dword [ebp + 0xc], 0x7fffffff
jbe 0x3000e03b
mov eax, 0x80070057
jmp 0x3000e04b
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0xc]
push edi
call fcn.3000cd1d
mov dword [0x30076cfc], eax
jmp 0x3000e05c
test esi, esi
je 0x3000e05c
mov word [edi + esi*2], 0x22
xor eax, eax
cmp dword [ebp + 8], eax
jbe 0x3000e06d
cmp dword [ebp + 8], 0x104
ja 0x3000e06d
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 8

Function at 0x3000e435
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, edi
call ebx
cmp eax, 0xffffffff
je 0x3000e456
test al, 0x10
jne 0x3000e4e7
push edi
push 0x30001928
call fcn.3000ff32
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [edi + eax*2 + 2], 0x5c
je 0x3000e495
cmp dword [ebp + 0xc], 0x7fffffff
jbe 0x3000e482
mov eax, 0x80070057
jmp 0x3000e490
push 0x30001920
push dword [ebp + 0xc]
push edi
call fcn.3000ce53
mov dword [0x30076cfc], eax
and dword [ebp + 0xc], 0
push 0x5c
push esi
call fcn.30015a7f
mov esi, eax
test esi, esi
je 0x3000e4ad
and word [esi], 0
jmp 0x3000e4b4
mov dword [ebp + 0xc], 1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test esi, esi
je 0x3000e4c8
mov word [esi], 0x5c
inc esi
inc esi
cmp dword [ebp + 0xc], 0
je 0x3000e499
push edi
call ebx
cmp eax, 0xffffffff
je 0x3000e4eb
test al, 0x10
je 0x3000e4eb
push edi
push 0x300018e0
call fcn.3000ff32
pop ecx
pop ecx
xor eax, eax
jmp 0x3000e4fb
push edi
push 0x30001898
call fcn.3000ff32
pop ecx
pop ecx
push 3
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x3000e5a8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x30034be8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp eax, edx
mov dword [ebp - 0x464], edx
je 0x3000e72b
cmp word [eax], dx
je 0x3000e72b
mov ecx, dword [ebp + 8]
cmp ecx, edx
je 0x3000e72b
cmp word [ecx], dx
je 0x3000e72b
push ebx
push esi
push edi
push eax
mov edi, 0x105
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.3000cd1d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x30076cfc], eax
lea eax, [ebp - 0x210]
push eax
call ebx
mov esi, eax
test esi, esi
jbe 0x3000e640
cmp esi, 0x104
jae 0x3000e640
cmp word [ebp + esi*2 - 0x212], 0x5c
je 0x3000e640
mov word [ebp + esi*2 - 0x210], 0x5c
inc esi
and word [ebp + esi*2 - 0x210], 0
cmp dword [ebp + 0x14], 0x7fffffff
jbe 0x3000e650
mov eax, 0x80070057
jmp 0x3000e662
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.3000cd1d
push dword [ebp + 8]
mov dword [0x30076cfc], eax
call ebx
add eax, esi
cmp eax, edi
jae 0x3000e687
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.3000ce53
mov dword [0x30076cfc], eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x3000e710
test byte [ebp - 0x460], 0x10
jne 0x3000e6f7
cmp word [ebp - 0x22c], 0
je 0x3000e6cd
cmp dword [ebp + 0x14], 0x7fffffff
jbe 0x3000e6c5
mov eax, 0x80070057
jmp 0x3000e6e8
lea eax, [ebp - 0x22c]
jmp 0x3000e6dc
cmp dword [ebp + 0x14], 0x7fffffff
ja 0x3000e6be
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.3000ce53
mov dword [0x30076cfc], eax
mov dword [ebp - 0x464], 1
lea eax, [ebp - 0x460]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x3000e710
and dword [ebp - 0x464], 0
test esi, esi
je 0x3000e720
cmp esi, 0xffffffff
je 0x3000e720
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x464]
pop edi
pop esi
pop ebx
jmp 0x3000e72d
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.3001f57d
leave
ret 0x10
Function at 0x3000f7df
Capabilities:
Check if file exists
Create directory
Get file attributes
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x598]
sub esp, 0x618
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push dword [ebp + 0x5a0]
mov dword [ebp + 0x594], eax
xor eax, eax
xor esi, esi
mov word [ebp + 0x388], si
mov ecx, 0x82
lea edi, [ebp + 0x38a]
rep stosd dword es:[edi], eax
push 0x105
lea eax, [ebp + 0x388]
push eax
call fcn.3000cd1d
mov dword [0x30076cfc], eax
push 0x5c
lea eax, [ebp + 0x388]
push eax
call fcn.30015aae
cmp eax, esi
je 0x3000f92b
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [eax], si
lea eax, [ebp + 0x388]
push eax
call edi
cmp eax, 0xffffffff
jne 0x3000f87c
push esi
lea eax, [ebp + 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0x388]
push eax
call edi
cmp eax, 0xffffffff
je 0x3000f92b
cmp dword [0x30077200], esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, 0x40000000
je 0x3000f8aa
push esi
push 0x80
push 4
push esi
push esi
push ebx
push dword [ebp + 0x5a0]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
jne 0x3000f8c5
push esi
push 0x80
push 2
push esi
push esi
push ebx
push dword [ebp + 0x5a0]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
je 0x3000f92b
push 2
push esi
push esi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push esi
push 0x400
lea eax, [ebp - 0x78]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x5a0]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call edi
push esi
lea eax, [ebp - 0x80]
push eax
push 2
push 0x300020f4
push dword [ebp - 0x7c]
call edi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x3000f92d
xor eax, eax
mov ecx, dword [ebp + 0x594]
pop edi
pop esi
pop ebx
call fcn.3001f57d
add ebp, 0x598
leave
ret 4
Function at 0x3000f9b7
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x30034be8]
and word [ebp - 0x210], 0
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
mov edi, 0x30002110
push edi
mov esi, 0x105
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.3000d759
mov dword [0x30076cfc], eax
add esp, 0x14
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x3000fa62
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push esi
push eax
call fcn.3000d759
mov dword [0x30076cfc], eax
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x460]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x3000fa23
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 8

Function at 0x3000fcd6
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x3000fdf4
cmp byte [eax], 0
je 0x3000fdf4
cmp word [0x30036048], si
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push edi
mov ebp, 0x30036258
je 0x3000fdb2
push esi
push 0x80
push 4
push esi
push esi
push 0x40000000
push 0x30036048
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x3000fd34
mov word [0x30036048], si
jmp 0x3000fdb2
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [0x30036258], 0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x3000fd75
push 0
lea eax, [esp + 0x14]
push eax
push ebp
call ebx
push eax
push ebp
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x300020f4
push edi
call esi
mov byte [0x30036258], 0
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x3000fda1
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
call ebx
push eax
push dword [esp + 0x24]
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x300020f4
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [0x30036048], 0
jne 0x3000fdf1
push ebp
call ebx
push dword [esp + 0x18]
mov esi, eax
call ebx
lea eax, [esi + eax + 3]
cmp eax, 0x800
jge 0x3000fdea
push dword [esp + 0x18]
mov esi, 0x8000
push esi
push ebp
call fcn.3000f7a9
test eax, eax
jl 0x3000fdf1
push 0x300020f4
push esi
push ebp
call fcn.3000f7a9
jmp 0x3000fdf1
mov byte [0x30036258], 0
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4
Function at 0x3001038d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
cmp word [esi], 0
push edi
mov edi, 0x30056678
je 0x300103b5
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x30003028
call fcn.3000ff32
add esp, 0x14
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esi], 0
mov edi, eax
je 0x300103e0
push dword [ebp + 0x14]
push 0x30003014
call fcn.3000ff32
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x3001073f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov eax, 0x801c
lea ebp, [esp - 0x7f9c]
call fcn.3001f58a
mov eax, dword [0x30034be8]
push ebx
xor ebx, ebx
cmp dword [0x30076d08], ebx
mov dword [ebp + 0x7f98], eax
jne 0x3001076f
xor eax, eax
inc eax
jmp 0x30010893
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp + 0x7f90]
push eax
mov byte [ebp + 0x7f90], bl
mov byte [ebp + 0x7f91], bl
mov byte [ebp + 0x7f92], bl
mov byte [ebp + 0x7f93], bl
mov byte [ebp + 0x7f94], bl
mov byte [ebp + 0x7f95], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x30010893
cmp dword [0x30076d08], 0x1f4
push esi
mov dword [ebp - 0x74], ebx
jb 0x3001080f
push 0x30003234
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x30010886
push 0x3000321c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x30010886
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp - 0x78]
push ebx
call eax
test eax, eax
jne 0x30010806
mov dword [ebp - 0x74], ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x30010886
lea eax, [ebp - 0x7c]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x3001082d
xor eax, eax
jmp 0x30010892
lea eax, [ebp - 0x80]
push eax
push 0x8000
lea eax, [ebp - 0x70]
push eax
push 2
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x7c]
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x74], ebx
je 0x30010829
push edi
xor edi, edi
cmp dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
jbe 0x30010885
lea esi, [ebp - 0x6c]
push dword [esi]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x3001087e
inc edi
add esi, 8
cmp edi, dword [ebp - 0x70]
jb 0x30010864
jmp 0x30010885
mov dword [ebp - 0x74], 1
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x74]
pop esi
mov ecx, dword [ebp + 0x7f98]
pop ebx
call fcn.3001f57d
add ebp, 0x7f9c
leave
ret
Function at 0x30010917
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
push edi
mov edi, reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
cmp ebx, 1
jne 0x3001092b
mov edi, SysReAllocString
push 0x30002a68
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
je 0x30010945
inc ebx
cmp ebx, 2
jl 0x30010921
jmp 0x3001094f
push 0x300032c8
call fcn.3000fe20
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x30010d0f
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x300035ec
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
push 8
pop ecx
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
mov esi, 0x300035cc
lea edi, [ebp - 0x24]
push 0x20019
rep movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
lea eax, [ebp - 0x4c]
push eax
push SysReAllocString
mov dword [ebp - 0x50], 0x105
mov dword [ebp - 0x58], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [ebp + 8]
mov ebx, 0x30002840
jne 0x30010e15
lea eax, [ebp - 0x50]
push eax
push edi
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x54]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30010e09
cmp dword [ebp + 8], 1
jne 0x30010e09
cmp dword [ebp - 0x50], edi
je 0x30010e09
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + eax + 1]
push eax
mov ecx, esi
mov dword [ebp - 0x50], eax
call fcn.3000cd95
mov edi, eax
test edi, edi
je 0x30010dc7
push 0x300035a0
jmp 0x30010e62
mov eax, dword [esi]
lea ecx, [ebp - 0x50]
push ecx
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30010e07
mov eax, dword [esi]
mov ecx, dword [ebp - 0x50]
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x30010df9
push 0x5c
mov ecx, esi
call fcn.3000ccac
push ebx
mov ecx, esi
call fcn.3000cf63
mov edi, eax
test edi, edi
je 0x30010e68
xor edi, edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x54], edi
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x50]
push eax
mov ecx, esi
call fcn.3000cd95
inc dword [ebp - 0x58]
mov edi, eax
test edi, edi
jne 0x30010e88
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
mov dword [ebp - 0x50], eax
je 0x30010e8f
cmp dword [esi + 4], eax
je 0x30010e15
push 0x5c
mov ecx, esi
call fcn.3000ccac
push ebx
mov ecx, esi
call fcn.3000cf63
mov edi, eax
test edi, edi
je 0x30010e68
push 0x30003570
call fcn.3000fdf9
pop ecx
cmp dword [ebp - 0x54], 0
je 0x30010e77
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 4
push 0x30001584
jmp 0x30010e62
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x30010e79