joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30004d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
lea edi, [eax + 0x64]
jmp 0x30004dc1
push dword [ebp + 8]
call fcn.30006d0a
test eax, eax
pop ecx
je 0x30004e50
push edi
push 0x40
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x30004db0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, 0x16
push ebx
call edi
lea ebx, [ebx + eax*2 + 4]
mov esi, ebx
sub esi, dword [ebp - 8]
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
push ebx
call edi
lea ebx, [ebx + eax*2 + 5]
mov eax, dword [ebp - 4]
lea ecx, [esi + eax]
mov eax, dword [ebp - 0x10]
sub eax, esi
add eax, 0x64
shr eax, 1
and ebx, 0xfffffffc
cmp eax, 0x7fffffff
mov dword [ebp - 0xc], ecx
ja 0x30004e22
push 0x300013a0
push eax
push ecx
call fcn.30002c36
push dword [ebp - 0xc]
call edi
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*2 + 5]
mov ecx, dword [ebp - 0x10]
sub ecx, ebx
add ecx, dword [ebp - 8]
shr eax, 2
push ecx
shl eax, 2
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x30004e4b
Function at 0x30005856
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x7b0]
sub esp, 0x830
mov eax, dword [0x30012970]
mov dword [ebp + 0x7ac], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
cmp dword [0x30013430], eax
push esi
jne 0x30005890
cmp dword [0x300126a0], eax
jne 0x300058f2
mov eax, 0x352
jmp 0x3000589d
cmp dword [0x300126a0], eax
jne 0x300058f2
mov eax, 0x355
push edi
push 0x80
lea ecx, [ebp + 0x6ac]
push ecx
push eax
call fcn.30006db2
add esp, 0x10
lea eax, [ebp + 0x6ac]
push eax
mov esi, 0x134
push esi
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea eax, [ebp - 0x80]
push eax
push esi
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x80]
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 1
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x135
push edi
call fcn.30004a27
cmp dword [0x300126a0], 0
pop ecx
pop ecx
mov esi, 0x30012e18
jne 0x30005912
mov esi, 0x30013020
push 0x135
push edi
call ebx
push 0x104
lea ecx, [ebp - 0x6c]
push ecx
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test esi, esi
mov dword [0x300129d8], esi
je 0x3000593d
cmp word [esi], 0
jne 0x30005947
and word [ebp + 0x19c], 0
jmp 0x30005968
push 0x288
lea eax, [ebp + 0x19c]
push eax
push 0x104
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
call fcn.30003ddb
add esp, 0x18
lea eax, [ebp + 0x19c]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp word [ebp + 0x19c], 0
lea eax, [ebp + 0x19c]
mov dword [0x300129d8], eax
je 0x300059bd
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x80]
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 1
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0xcc
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x7ac]
pop esi
pop ebx
call fcn.300101bf
add ebp, 0x7b0
leave
ret
Function at 0x30006414
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x30006438
xor eax, eax
leave
ret
push esi
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp - 4]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x30006474
cmp dword [ebp - 8], esi
jne 0x30006474
push dword [ebp + 0x14]
call fcn.3000692a
pop ecx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x30006476
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x300064f9
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x8c
mov eax, dword [0x30012970]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
mov dword [ebp + 0x64], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
push 0x20006
push eax
mov ebx, 0x300017dc
push ebx
push eax
push str.Software
mov edi, 0x80000001
push edi
call esi
test eax, eax
jne 0x30006621
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push ebx
push eax
push str.SoftwareMicrosoft
push edi
call esi
test eax, eax
jne 0x30006621
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push ebx
push eax
push str.SoftwareMicrosoftOfficeProfileWizard
push edi
call esi
test eax, eax
jne 0x30006621
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push ebx
push eax
push str.SoftwareMicrosoftOfficeProfileWizard11.0
push edi
call esi
test eax, eax
jne 0x30006621
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x78], 0
lea eax, [ebp - 0x1c]
jbe 0x300065ec
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 0x300017e8
push 0x40
push eax
call fcn.30003db4
add esp, 0x14
jmp 0x300065f7
push dword [ebp + 0x74]
push 0x40
push eax
call fcn.30002c36
xor eax, eax
cmp dword [ebp + 0x7c], eax
mov ecx, str.SoftwareMicrosoftOfficeProfileWizard11.0RecentFileList
jne 0x30006608
mov ecx, str.SoftwareMicrosoftOfficeCustomizeWizard11.0RecentShortcutLocationList
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x20]
push edx
push eax
push 0x20006
push eax
push ebx
push eax
push ecx
push edi
call esi
test eax, eax
je 0x30006625
xor eax, eax
jmp 0x30006659
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x70]
lea eax, [ebp - 0x1c]
push 1
push 0
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x20]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp + 0x64]
pop edi
pop esi
pop ebx
call fcn.300101bf
add ebp, 0x68
leave
ret

Function at 0x3000684a
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x30006868
cmp word [eax], 0
je 0x30006868
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
ret
xor eax, eax
ret

Function at 0x3000686b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x3000688d
cmp word [eax], 0
je 0x3000688d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3000688d
test al, 0x10
je 0x3000688d
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x30006a1b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call fcn.3000684a
test eax, eax
pop ecx
jne 0x30006a31
or eax, 0xffffffff
leave
ret
push esi
mov esi, dword [0x30012990]
push edi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.30002d97
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [0x30012990], esi
jne 0x30006a5b
or eax, eax
jmp 0x30006a7e
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 4], 0
mov esi, eax
je 0x30006a75
or esi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x30006c8d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x30006d05
cmp word [ebx], 0
je 0x30006d05
push ebx
call fcn.3000686b
test eax, eax
pop ecx
je 0x30006caf
xor eax, eax
inc eax
jmp 0x30006d07
push esi
push edi
push ebx
call fcn.3000690b
and word [eax], 0
push ebx
mov dword [ebp - 4], eax
call fcn.300069a6
mov esi, eax
mov di, word [esi]
and word [esi], 0
push ebx
call fcn.30006c8d
add esp, 0xc
test eax, eax
mov word [esi], di
pop edi
mov dword [ebp + 8], eax
pop esi
je 0x30006cf8
push ebx
call fcn.3000686b
test eax, eax
pop ecx
jne 0x30006cf8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
mov word [eax], 0x5c
mov eax, dword [ebp + 8]
jmp 0x30006d07
xor eax, eax
pop ebx
leave
ret

Function at 0x30007193
Capabilities:
Accept command line arguments

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov cx, word [eax]
cmp cx, 0x22
jne 0x300071bc
mov esi, dword [sym.imp.USER32.dll_CharNextW]
push eax
call esi
mov cx, word [eax]
cmp cx, 0x22
je 0x300071e0
test cx, cx
jne 0x300071a9
jmp 0x300071eb
test cx, cx
je 0x300071eb
mov esi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x20
je 0x300071e3
push eax
call esi
mov cx, word [eax]
test cx, cx
jne 0x300071c7
jmp 0x300071e3
cmp cx, 0x20
ja 0x300071eb
push eax
call esi
mov cx, word [eax]
test cx, cx
jne 0x300071da
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.30007174
add esp, 0xc
pop esi
ret

Function at 0x300073ab
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x30012970]
push esi
mov dword [ebp - 4], eax
mov esi, 0x12c
push esi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x25c]
push eax
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x300073f5
push 0x3000135c
push esi
lea eax, [ebp - 0x25c]
push eax
call fcn.3000405a
push dword [ebp + 8]
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.3000405a
lea eax, [ebp - 0x25c]
push eax
call fcn.3000684a
test eax, eax
pop ecx
pop esi
je 0x30007426
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x30007428
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.300101bf
leave
ret
Function at 0x3000781b
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x30012970]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
mov ebx, 0x3000135c
je 0x3000785f
cmp edi, 0x7fffffff
ja 0x3000785f
push ebx
push edi
push esi
call fcn.3000405a
push esi
call fcn.30006c8d
test eax, eax
pop ecx
je 0x300078b2
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x300019d8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x300078b2
lea eax, [ebp - 0x20c]
push eax
call fcn.3000684a
test eax, eax
pop ecx
je 0x300078b2
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call fcn.3000684a
test eax, eax
pop ecx
je 0x300078d7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x300078d7
cmp edi, 0x7fffffff
ja 0x300078d7
push ebx
push edi
push esi
call fcn.3000405a
push 0x104
push esi
call fcn.30007b45
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
inc eax
pop ebx
call fcn.300101bf
leave
ret
Function at 0x300086c0
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
sub esp, 0x20c
cmp word [0x300126a4], 0xffff
mov eax, dword [0x30012970]
mov dword [esp + 0x208], eax
mov eax, dword [0x30013430]
jne 0x300086ef
test eax, eax
jne 0x300086ef
or word [0x300126a4], 0xffff
cmp word [0x30012c10], 0
push ebx
push esi
mov ebx, 0x30012c10
push edi
mov dword [0x300129d8], ebx
mov edi, 0x104
jne 0x3000871e
neg eax
sbb eax, eax
add eax, 0x322
push eax
mov eax, edi
call fcn.30007c4f
pop ecx
push ebp
push edi
mov esi, 0x30012e18
push esi
mov ebp, 0x30001ad4
push ebp
push str.SoftwareMicrosoftOffice11.0CommonGeneralSettings
mov ebx, 0x80000001
push ebx
call fcn.30006414
add esp, 0x14
cmp word [0x30012e18], 0
mov dword [0x300129d8], esi
jne 0x30008760
push edi
push esi
push ebp
push 0x30012730
push ebx
call fcn.30006414
add esp, 0x14
cmp word [0x30012e18], 0
mov dword [0x300129d8], esi
pop ebp
je 0x30008794
push esi
push edi
mov ebx, 0x30013020
push ebx
call fcn.30002c36
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push edi
push esi
call fcn.30002c36
jmp 0x3000886f
push 1
push 0
push 0x300017c8
push edi
push esi
call fcn.30006484
add esp, 0x14
test eax, eax
je 0x300087b4
push esi
push edi
push 0x30013020
jmp 0x3000878a
push 5
push esi
call fcn.30007ba1
test eax, eax
pop ecx
pop ecx
je 0x300087e9
push esi
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x300087db
push 0x3000135c
push edi
push esi
call fcn.3000405a
push esi
push edi
push 0x30013020
call fcn.30002c36
jmp 0x30008824
push edi
push esi
push 0x30001ac0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push ebx
call fcn.30006414
add esp, 0x14
test eax, eax
jne 0x3000880b
push 0x30001a9c
push edi
push esi
jmp 0x300087e2
push esi
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x30008824
push 0x3000135c
push edi
push esi
call fcn.3000405a
push 0
push edi
lea eax, [esp + 0x14]
push eax
push 0x32f
call fcn.30006db2
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.3000405a
push 0x300019cc
push edi
push esi
call fcn.3000405a
push 0
push edi
lea eax, [esp + 0x14]
push eax
push 0x16
call fcn.30006db2
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.3000405a
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
call fcn.300101bf
add esp, 0x20c
ret
Function at 0x300098b3
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
movzx eax, byte [ebp + 0xc]
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0x10]
sub eax, 0x80000000
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x30009991
cmp dword [ebp + 0x1c], esi
push esi
push esi
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push esi
je 0x300098fc
push esi
push esi
push esi
push eax
lea eax, [ebp + 0xc]
push eax
jmp 0x30009904
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x30009917
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0xc], esi
jbe 0x30009985
push ebx
push dword [ebp + 0x18]
mov ebx, dword [ebp - 4]
push dword [ebp + 0x14]
dec dword [ebp + 0xc]
push dword [ebp + 8]
inc ebx
call fcn.30009287
add esp, 0xc
cmp eax, esi
je 0x30009981
mov ecx, dword [ebp - 4]
add eax, 8
inc ecx
cmp dword [ebp + 0x1c], esi
mov dword [ebp - 0xc], ecx
je 0x30009962
lea ecx, [ebp - 0x18]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x3000997a
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp dword [ebp + 0xc], esi
ja 0x3000991d
jmp 0x30009984
mov dword [ebp + 0xc], esi
pop ebx
push dword [ebp - 8]
dec dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x30009997
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
test edi, edi
mov eax, dword [0x30012970]
mov dword [ebp - 4], eax
je 0x300099ed
mov dword [ebp - 0x18], edi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x1c], 0x10
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test edi, edi
mov esi, eax
jne 0x300099dd
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x30009a13
cmp esi, 0xea
je 0x30009a13
xor eax, eax
jmp 0x30009a16
lea eax, [ebp - 0x18]
push eax
movzx eax, byte [ebp + 8]
push 0x20019
push 0
push dword [ebp + 0xc]
sub eax, 0x80000000
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x300099ac
xor eax, eax
jmp 0x30009a17
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.300101bf
leave
ret
Function at 0x30009e96
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x20c
mov eax, dword [0x30012970]
push ebx
push ebp
push edi
push 0x13b
mov ebx, 0x13d
push ebx
push esi
mov dword [esp + 0x220], eax
call fcn.30003ac4
push ebx
push esi
call fcn.30004a27
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
add esp, 0x14
xor eax, eax
cmp dword [0x300126a0], eax
push 0
setne al
mov edi, 0xf1
push eax
push edi
push 0x156
push esi
call ebp
xor eax, eax
cmp dword [0x300126a0], eax
push 0
sete al
push eax
push edi
push 0x157
push esi
call ebp
xor eax, eax
cmp dword [0x30012810], eax
push 0
setne al
push eax
push edi
push 0x158
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
cmp dword [0x30013438], eax
sete al
push eax
push 0x156
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
and dword [0x30013cc8], 0
and dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
add eax, 0x159
push eax
push esi
call edi
test eax, eax
mov dword [esp + 0x10], eax
je 0x30009fce
push 0xff
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor ecx, ecx
cmp word [esp + 0x14], cx
lea eax, [esp + 0x14]
mov dword [0x300129d8], eax
je 0x30009fc3
cmp word [esp + 0x14], 0x2a
je 0x30009fc3
cmp dword [0x30013cc8], ecx
jne 0x30009f99
mov eax, dword [esp + 0xc]
add eax, 0x159
mov dword [0x30013cc8], eax
xor eax, eax
push ecx
mov ecx, dword [esp + 0x10]
inc eax
shl eax, cl
and ax, word [0x300126a4]
neg ax
sbb eax, eax
neg eax
push eax
push 0xf1
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x30009fce
push ecx
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x10
jb 0x30009f43
push 0x30012e18
push ebx
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
push 0x103
push 0xc5
push ebx
push esi
call ebp
xor eax, eax
cmp dword [0x300126a0], eax
sete al
push eax
push 0x158
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 0x30012e18
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
test eax, eax
setg cl
push 0
push 0xc9
push esi
mov dword [esp + 0x1c], ecx
call edi
push eax
call ebp
push dword [esp + 0x10]
push 0xcc
push esi
call edi
push eax
call ebp
push ebx
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp + 0x214]
pop edi
pop ebp
pop ebx
call fcn.300101bf
add esp, 0x20c
ret
Function at 0x3000a748
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x3e4]
sub esp, 0x464
mov eax, dword [0x30012970]
push dword [ebp + 0x3ec]
mov dword [ebp + 0x3e0], eax
push 0x104
lea eax, [ebp + 0x1d8]
push eax
call fcn.30002c36
lea eax, [ebp + 0x1d8]
push eax
call fcn.300069a6
pop ecx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x3ec]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x80], eax
je 0x3000a857
push ebx
push esi
mov ebx, 0x7fffffff
test byte [ebp - 0x78], 0x10
jne 0x3000a82d
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp + 0x1d8]
sub eax, ecx
sar eax, 1
mov esi, 0x104
sub esi, eax
cmp esi, ebx
ja 0x3000a7d6
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp - 0x7c]
call fcn.30002c36
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_CharUpperW]
push dword [ebp + 0x3f0]
mov eax, dword [0x30014304]
push dword [ebp - 0x7c]
push 0
push 0x66
call fcn.300095f1
add esp, 0x10
test eax, eax
jne 0x3000a82d
cmp esi, ebx
ja 0x3000a80e
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp - 0x7c]
call fcn.30002c36
push 0x80
lea eax, [ebp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x3000a84b
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x80], 0xffffffff
cmp dword [ebp - 0x80], 0xffffffff
jne 0x3000a7ab
pop esi
pop ebx
mov ecx, dword [ebp + 0x3e0]
xor eax, eax
call fcn.300101bf
add ebp, 0x3e4
leave
ret

Function at 0x3000a86c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 0x10]
mov edi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.30009997
add esp, 0xc
test eax, eax
je 0x3000a8f1
cmp dword [ebp + 0x14], 0
je 0x3000a8ad
push dword [ebp + 0x10]
mov eax, dword [0x30014310]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.30009a21
add esp, 0xc
test eax, eax
je 0x3000a8ad
push 7
pop eax
jmp 0x3000a8f3
test edi, edi
je 0x3000a8b6
mov dword [ebp - 4], edi
jmp 0x3000a8d8
lea eax, [ebp - 4]
push eax
movzx eax, byte [ebp + 8]
push 0x20006
push 0
push dword [ebp + 0xc]
sub eax, 0x80000000
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x3000a8f1
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
jne 0x3000a8f1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
leave
ret