joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x485ba6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x485ba6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x485b87
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4a662f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a6667
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a46e6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a46be
jmp 0x4a6673
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a7d21
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a7d63
call fcn.004ad899
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a7d63
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a7d5a
xor eax, eax
jmp 0x4a7d6b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a7d71
pop edi
pop esi
pop ebx
ret 4

Function at 0x4addc9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4addf7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ade15
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004add2f
jmp 0x4ade15
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ade15
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004add2f
test edi, edi
mov eax, edi
jne 0x4addff
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x3000579a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x3002eaf4], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
je 0x300057bd
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov dword [ebp - 4], eax
jmp 0x30005808
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push edi
mov ebx, eax
push edi
push 0xffffffffffffffff
push ebx
push edi
push edi
call esi
cmp eax, edi
jne 0x300057e0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
inc eax
mov dword [ebp - 8], eax
add eax, eax
push eax
lea eax, [ebp - 4]
push eax
call fcn.300244ab
test eax, eax
je 0x300058a8
push dword [ebp - 8]
push dword [ebp - 4]
push 0xffffffffffffffff
push ebx
push edi
push edi
call esi
mov eax, dword [ebp - 4]
mov cx, word [eax]
push 2
pop edx
cmp cx, 0x22
push 0x20
pop esi
jne 0x3000582f
add eax, edx
mov cx, word [eax]
cmp cx, 0x22
je 0x3000582b
cmp cx, di
je 0x3000583b
add eax, edx
jmp 0x30005819
add eax, edx
jmp 0x3000583b
cmp cx, si
jbe 0x3000583b
add eax, edx
cmp word [eax], si
ja 0x30005834
mov cx, word [eax]
cmp cx, di
je 0x30005848
cmp cx, si
jbe 0x3000582b
push eax
mov dword [0x3002ed00], edi
call fcn.300079d1
cmp dword [ebp - 8], edi
mov ebx, eax
je 0x30005863
push dword [ebp - 4]
call fcn.300245ad
mov eax, ebx
and eax, 0x60
jne 0x300058ae
push 8
pop eax
test al, bl
jne 0x300058ae
mov edx, 0x2ee
test edx, ebx
je 0x300058a8
xor ecx, ecx
push 1
pop eax
shl eax, cl
test edx, eax
je 0x30005891
test ebx, eax
je 0x30005891
mov edi, ebx
sub edi, eax
test edx, edi
jne 0x300058a8
inc ecx
cmp ecx, esi
jb 0x3000587c
test bl, 4
je 0x300058ac
mov ecx, ebx
mov eax, 0x100
and ecx, eax
cmp ecx, eax
je 0x300058ac
xor eax, eax
jmp 0x300058ae
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x300058b3
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x3002ed00]
push ebx
xor ebx, ebx
mov dword [0x3002ac1c], eax
push ebx
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, ebx
mov dword [0x3002ac18], eax
je 0x30005a46
cmp dword [eax], 0x1c50
jne 0x30005a46
cmp dword [eax + 0x20], ebx
je 0x30005a46
cmp dword [eax + 0x14], ebx
je 0x30005a46
cmp dword [eax + 0x1c], ebx
je 0x30005a46
cmp dword [0x3002ed10], ebx
jne 0x30005911
cmp dword [eax + 0x24], ebx
je 0x30005a46
cmp word [eax + 0xb6], bx
jne 0x30005a46
cmp word [eax + 0x2be], bx
jne 0x30005a46
cmp word [eax + 0x4c6], bx
jne 0x30005a46
cmp word [eax + 0x6ce], bx
jne 0x30005a46
cmp word [eax + 0x8d6], bx
jne 0x30005a46
cmp word [eax + 0xade], bx
jne 0x30005a46
cmp word [eax + 0xb4e], bx
jne 0x30005a46
cmp word [eax + 0xd56], bx
jne 0x30005a46
cmp word [eax + 0xdc6], bx
jne 0x30005a46
cmp word [eax + 0xe36], bx
jne 0x30005a46
cmp word [eax + 0x1416], bx
jne 0x30005a46
cmp word [eax + 0x1c16], bx
jne 0x30005a46
cmp byte [eax + 0xf3b], bl
jne 0x30005a46
cmp byte [eax + 0x103f], bl
jne 0x30005a46
cmp byte [eax + 0x1143], bl
jne 0x30005a46
cmp byte [eax + 0x120f], bl
jne 0x30005a46
cmp byte [eax + 0x1c4f], bl
jne 0x30005a46
mov eax, dword [eax + 0x28]
push 1
test al, 0x20
pop ecx
je 0x300059ed
mov dword [0x3002eab4], ecx
test ah, 0x80
je 0x300059f8
mov dword [0x3002ed20], ecx
test eax, 0x20000
je 0x30005a05
mov dword [0x3002ed28], ecx
test ah, 0x20
je 0x30005a10
mov dword [0x3002ed14], ecx
test ah, 0x40
je 0x30005a1b
mov dword [0x3002ed18], ecx
test eax, 0x40000
je 0x30005a28
mov dword [0x3002ed2c], ecx
test eax, 0x80000
je 0x30005a35
mov dword [0x3002ed30], ecx
test eax, 0x100000
je 0x30005a42
mov dword [0x3002ed34], ecx
mov eax, ecx
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x3000749a
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
call fcn.3000b6d4
test eax, eax
je 0x300074aa
int3
call fcn.3000adb9
cmp dword [0x3002eaf4], 0
je 0x300074ca
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
xor eax, eax
cmp dword [ebp - 0x2c], 0xffffffff
jmp 0x300074da
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
xor eax, eax
cmp dword [ebp - 0x2c], 0xffffffff
sete al
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x3000800a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov al, byte [0x30007f9e]
push ebx
push esi
push edi
push 0xe
mov byte [ebp - 1], al
pop ecx
xor esi, esi
push 0xfffffffffffffff8
xor eax, eax
push dword [ebp + 8]
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x40], esi
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.DLL_GetWindowLongA]
mov edi, dword [sym.imp.USER32.DLL_SetWindowPos]
push 3
push esi
push esi
push esi
mov ebx, eax
push esi
push 0xfffffffffffffffe
push ebx
call edi
push 3
push esi
push esi
push esi
push esi
push esi
push ebx
call edi
push 3
push esi
push esi
push esi
push esi
push ebx
push dword [ebp + 8]
call edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], esi
je 0x3000810a
push 0x30007fa2
call fcn.3000d867
test eax, eax
je 0x3000810a
push dword [0x300320bc]
lea eax, [ebp - 0x5c]
push 0x30007fb2
push 0x19
push eax
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
lea eax, [ebp - 0x160]
push eax
call fcn.3000aae1
test eax, eax
je 0x3000814c
mov esi, 0x30007fb6
push esi
call fcn.300256b0
mov edi, eax
lea eax, [ebp - 0x160]
push eax
call fcn.300256b0
lea ecx, [edi + eax + 1]
mov eax, 0x104
cmp ecx, eax
jg 0x3000814c
push eax
lea eax, [ebp - 0x160]
push eax
push esi
call fcn.3000f38f
lea eax, [ebp - 0x160]
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 0xa
call dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
jmp 0x3000814c
mov eax, dword [edi + 0x24]
cmp eax, esi
jne 0x30008114
lea eax, [ebp - 1]
mov edi, dword [edi + 0x64]
cmp edi, esi
jne 0x3000811e
lea edi, [ebp - 1]
push edi
push eax
push dword [0x300320bc]
lea eax, [ebp - 0x564]
push 0x30007fc6
push 0x401
push eax
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x18
lea eax, [ebp - 0x564]
push eax
call fcn.3000c391
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x3000a2fe
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
ret 8

Function at 0x3000adb9
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push edi
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x84], 2
pop edi
jne 0x3000ae2f
cmp dword [ebp - 0x90], 4
push 1
jae 0x3000ae02
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
cmp dword [ebp - 0x90], 5
pop eax
mov dword [0x3002eaf4], eax
mov dword [0x300320c0], eax
jb 0x3000ae56
cmp dword [ebp - 0x8c], eax
mov dword [0x3002eae8], eax
mov dword [0x3002eaf0], eax
jb 0x3000ae56
mov dword [0x3002eaec], eax
leave
ret
push 1
pop eax
cmp dword [ebp - 0x84], eax
je 0x3000ae41
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
cmp dword [ebp - 0x8c], 0
jbe 0x3000ae4f
mov dword [0x3002eae8], eax
and dword [0x3002eaf4], 0
leave
ret
Function at 0x3000af0b
Capabilities:
Link many functions at runtime

Disassembly:
or dword [0x3002eae4], 0xffffffff
push ebx
push esi
xor ebx, ebx
push edi
mov dword [0x3002a670], ebx
mov dword [0x3002ead8], ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov dword [0x3002eae0], eax
mov ecx, 0x7c6
xor eax, eax
mov edi, 0x3002b920
push 0x3002b94c
rep stosd dword es:[edi], eax
mov dword [0x3002ed08], ebx
mov dword [0x3002a678], ebx
call esi
call fcn.3000adb9
mov ecx, 0x341
xor eax, eax
mov edi, 0x3002ac18
rep stosd dword es:[edi], eax
mov ecx, 0x153
mov edi, 0x3002a6c8
rep stosd dword es:[edi], eax
mov eax, 0x3002a618
push eax
mov dword [0x3002ac08], eax
call esi
push 0x3002a638
call esi
mov edx, 0x200
xor eax, eax
mov ecx, edx
mov edi, 0x3002e2b0
rep stosd dword es:[edi], eax
mov ecx, edx
mov edi, 0x3002dab0
rep stosd dword es:[edi], eax
push 0x3002b2c8
call fcn.3000c5e4
push 0x3002b2d8
call fcn.3000c5e4
push 0x3002b2e8
call fcn.3000c5e4
push 0x106
push 0x10
call fcn.30024221
cmp eax, ebx
je 0x3000afd8
mov ecx, eax
call fcn.3000b2d5
jmp 0x3000afda
xor eax, eax
cmp eax, ebx
mov dword [0x3002a66c], eax
je 0x3000aff2
push 2
push 0x100
push 0x10
push eax
call fcn.3002714d
push ebx
push 0x3002eab8
push ebx
push 0x30
call dword [sym.imp.USER32.DLL_SystemParametersInfoA]
call fcn.3000ad80
mov edi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x3000b09b
push 0x3000ae58
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, ebx
mov dword [0x3002ed4c], eax
je 0x3000b09b
push 0x3000ae64
push eax
call esi
push 0x3000ae74
mov dword [0x3002ed3c], eax
push dword [0x3002ed4c]
call esi
push 0x3000ae80
mov dword [0x3002ed40], eax
push dword [0x3002ed4c]
call esi
push 0x3000ae8c
mov dword [0x3002ed44], eax
push dword [0x3002ed4c]
call esi
cmp dword [0x3002ed3c], ebx
mov dword [0x3002ed48], eax
je 0x3000b08d
cmp dword [0x3002ed40], ebx
je 0x3000b08d
cmp dword [0x3002ed44], ebx
je 0x3000b08d
cmp eax, ebx
jne 0x3000b09b
push dword [0x3002ed4c]
call edi
mov dword [0x3002ed4c], ebx
push 0x3000ae98
call fcn.3000fff2
cmp eax, ebx
mov dword [0x3002a664], eax
je 0x3000b0cd
push 0x3000aea4
push eax
call esi
cmp eax, ebx
mov dword [0x3002a668], eax
jne 0x3000b0cd
push dword [0x3002a664]
call edi
mov dword [0x3002a664], ebx
push 0x3000aeb4
call fcn.3000fff2
cmp eax, ebx
mov dword [0x3002a650], eax
je 0x3000b14d
push 0x3000aec0
push eax
call esi
push 0x3000aed8
mov dword [0x3002a660], eax
push dword [0x3002a650]
call esi
push 0x3000aeec
mov dword [0x3002a65c], eax
push dword [0x3002a650]
call esi
push 0x3000aefc
mov dword [0x3002a658], eax
push dword [0x3002a650]
call esi
cmp dword [0x3002a660], ebx
mov dword [0x3002a654], eax
je 0x3000b13f
cmp dword [0x3002a65c], ebx
je 0x3000b13f
cmp dword [0x3002a658], ebx
je 0x3000b13f
cmp eax, ebx
jne 0x3000b14d
push dword [0x3002a650]
call edi
mov dword [0x3002a650], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x3000b920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.3000b821
test eax, eax
je 0x3000ba07
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 0xc]
call fcn.30025695
lea eax, [ebp - 0x110]
push eax
call fcn.3000ebf3
mov edi, eax
cmp byte [edi], 0x5c
jne 0x3000ba07
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
push 0x20019
lea eax, [ebp - 0x110]
push ebx
push eax
mov byte [edi], bl
push dword [ebp - 4]
inc edi
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x3000ba07
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
sub eax, ebx
je 0x3000b9d8
dec eax
je 0x3000b9bb
dec eax
jne 0x3000b9fd
lea eax, [esi + 8]
push 3
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp + 0xc]
call fcn.3000b700
test eax, eax
je 0x3000b9fd
jmp 0x3000b9f7
push 1
lea eax, [esi + 8]
pop ebx
push ebx
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp + 0xc]
call fcn.3000b700
test eax, eax
je 0x3000b9fd
mov dword [esi], ebx
jmp 0x3000b9fd
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x3000b9fd
mov dword [esi], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x3000ba0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ebx
shl esi, 2
lea eax, [ebp - 8]
push esi
push eax
call fcn.300244ab
test eax, eax
je 0x3000bb45
mov ecx, esi
push edi
mov edi, dword [ebp - 8]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
test ebx, ebx
mov dword [ebp - 0xc], edi
jle 0x3000bb3c
mov eax, dword [ebp + 8]
push 1
pop ebx
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
mov eax, dword [ebp - 8]
cmp dword [eax + edi*4], 0
jne 0x3000bb29
mov eax, dword [esi]
cmp byte [eax], 0
jne 0x3000ba7a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x3000ba97
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
je 0x3000ba97
and dword [ebp - 4], 0
cmp edi, dword [ebp + 0xc]
jge 0x3000bb13
add esi, 0xfffffff8
mov eax, dword [ebp + 8]
push dword [eax]
push dword [esi + 8]
call fcn.3000f112
test eax, eax
jne 0x3000bb07
mov eax, dword [ebp - 8]
xor ecx, ecx
mov dword [eax + edi*4], ebx
mov edx, dword [ebp - 4]
cmp edx, ecx
je 0x3000bb07
mov eax, dword [esi + 4]
sub eax, ecx
je 0x3000bae5
dec eax
je 0x3000bad0
dec eax
jne 0x3000bb07
push 3
jmp 0x3000bad1
push ebx
lea eax, [esi - 4]
push esi
push eax
push dword [esi + 0xc]
push edx
call fcn.3000b700
test eax, eax
je 0x3000bb07
jmp 0x3000bb04
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [esi - 4]
push eax
push ecx
push ecx
push dword [esi + 0xc]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x3000bb07
mov dword [esi - 8], ebx
inc edi
add esi, 0x18
cmp edi, dword [ebp + 0xc]
jl 0x3000ba9f
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
je 0x3000bb26
test eax, eax
je 0x3000bb26
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov edi, dword [ebp - 0xc]
inc edi
add esi, 0x18
cmp edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], esi
jl 0x3000ba5e
push dword [ebp - 8]
call fcn.300245ad
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x3000bcb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x3002eaf4], esi
je 0x3000bd3f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.3000b821
test eax, eax
je 0x3000bd3f
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x3000bd3f
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x800
push eax
lea eax, [ebp - 0x10]
push 0x3002e2b0
push eax
push esi
push 0x3000bc96
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x3000bd36
cmp dword [ebp - 0x10], 1
je 0x3000bd29
mov word [0x3002e2b0], si
jmp 0x3000bd36
mov eax, dword [ebp + 8]
shr eax, 1
mov word [eax*2 + 0x3002e2ae], si
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
pop esi
leave
ret 4
Function at 0x3000bd44
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [0x3002ac18]
add eax, 0xf3c
push eax
push 0x3002a128
call fcn.3000b920
mov eax, dword [0x3002ac18]
test byte [eax + 0x28], 1
je 0x3000bd69
jmp fcn.3000bb4b
add eax, 0x1040
push eax
push 0x3002a140
call fcn.3000b920
ret

Function at 0x3000c391
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
and dword [ebp - 0x3c], 0
push esi
mov esi, dword [ebp + 8]
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
test esi, esi
rep stosd dword es:[edi], eax
je 0x3000c40a
cmp dword [0x3002eab4], eax
jne 0x3000c3c3
push esi
call fcn.3000eff6
test eax, eax
je 0x3000c3cd
push esi
call fcn.3000c282
test eax, eax
jne 0x3000c40a
lea eax, [ebp - 0x860]
push 0x824
push eax
push esi
call fcn.30025695
lea eax, [ebp - 0x860]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 0xa
call dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
test eax, eax
jne 0x3000c40a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
pop edi
pop esi
leave
ret 4

Function at 0x3000c5f6
Capabilities:
Get file size
Read file via mapping

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x3000c66c
xor edi, edi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x3000c661
cmp eax, edi
je 0x3000c661
push edi
push eax
push edi
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x3000c661
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x3000c65c
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [esi + 4]
call ebx
push dword [esi]
mov dword [esi + 4], edi
call ebx
or dword [esi], 0xffffffff
xor eax, eax
pop ebx
jmp 0x3000c66e
push 1
pop eax
jmp 0x3000c66e
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or dword [esi], 0xffffffff
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x3000cbb2
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
je 0x3000cc47
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x3000cc47
push edi
call fcn.3000ec16
cmp eax, edi
je 0x3000cc47
sub eax, edi
push esi
push esi
mov ebx, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sar eax, 1
push esi
push esi
push eax
push edi
push esi
mov dword [ebp - 8], eax
push dword [0x3002eacc]
call ebx
mov esi, eax
lea eax, [ebp - 4]
inc esi
push esi
push eax
call fcn.300244ab
test eax, eax
je 0x3000cc47
mov edi, dword [ebp - 4]
mov ecx, esi
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
push eax
push dword [0x3002eacc]
call ebx
test eax, eax
je 0x3000cc3f
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
push dword [ebp - 4]
call fcn.300245ad
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x3000d867
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [0x30001154]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 4

Function at 0x3000d87e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [0x30001154]
cmp eax, 0xffffffff
jne 0x3000d891
xor eax, eax
jmp 0x3000d894
and eax, 0x10
ret 4

Function at 0x3000d8af
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x3000d97f
push dword [ebp + 8]
call fcn.300256b0
mov ecx, 0x104
cmp eax, ecx
jge 0x3000d97f
lea eax, [ebp - 0x104]
push ecx
push eax
push dword [ebp + 8]
call fcn.30025695
lea eax, [ebp - 0x104]
push eax
call fcn.300256b0
lea esi, [ebp + eax - 0x104]
lea eax, [ebp - 0x104]
push eax
call fcn.3000d87e
test eax, eax
jne 0x3000d97a
lea eax, [ebp - 0x104]
mov ebx, esi
push eax
call fcn.3000ebf3
test edi, edi
mov esi, eax
je 0x3000d925
mov byte [ebx], 0x5c
lea eax, [ebp - 0x104]
cmp esi, eax
jbe 0x3000d97f
and byte [esi], 0
push 1
pop edi
lea eax, [ebp - 0x104]
push eax
call fcn.3000d87e
test eax, eax
je 0x3000d90e
mov byte [esi], 0x5c
inc esi
xor edi, edi
mov al, byte [esi]
cmp al, 0x5c
je 0x3000d958
test al, al
je 0x3000d958
inc esi
jmp 0x3000d94b
cmp byte [esi], 0x5c
jne 0x3000d963
and byte [esi], 0
push 1
pop edi
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x3000d97f
test edi, edi
jne 0x3000d945
push 1
pop eax
jmp 0x3000d981
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4