joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100289b8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push edi
mov eax, dword [0x1003230c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
push str.________RemoveUserProfileSettingsInternal_started.________
call fcn.10001180
mov ebp, 7
xor edi, edi
xor eax, eax
add esp, 4
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], edi
mov word [esp + 0x54], ax
mov dword [esp + 0x78], edi
xor ecx, ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], cx
xor edx, edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], edi
mov word [esp + 0x38], dx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x80], 2
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], edi
call fcn.10007220
add esp, 8
lea ebx, [ebp + 1]
test eax, eax
jne 0x10006ccd
lea edx, [esp + 0x18]
push edx
push 0x10033494
call fcn.10006ad0
add esp, 8
test eax, eax
jne 0x10006caf
push 0xb
mov eax, str._ntuser.dat
lea ecx, [esp + 0x54]
call fcn.10005c60
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x4c], ebx
jae 0x10006c87
lea ecx, [esp + 0x38]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebx
jae 0x10006c95
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x54]
cmp dword [esp + 0x68], ebx
jae 0x10006ca3
lea edx, [esp + 0x54]
push ecx
push eax
mov ecx, esi
call fcn.10006d60
add esp, 8
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x20]
call fcn.10007220
add esp, 8
test eax, eax
je 0x10006c53
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x10006cdc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._________RemoveUserProfileSettingsInternal_ended._________
call fcn.10001180
add esp, 4
cmp dword [esp + 0x4c], ebx
jb 0x10006cfc
mov edx, dword [esp + 0x38]
push edx
call fcn.10011720
add esp, 4
xor eax, eax
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], edi
mov word [esp + 0x38], ax
cmp dword [esp + 0x30], ebx
jb 0x10006d1e
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.10011720
add esp, 4
xor edx, edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], dx
cmp dword [esp + 0x68], ebx
jb 0x10006d40
mov eax, dword [esp + 0x54]
push eax
call fcn.10011720
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.1001172b
add esp, 0x6c
ret
Function at 0x10007770
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10028406
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x288], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003230c]
xor eax, esp
push eax
lea eax, [esp + 0x2a0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2b0]
mov esi, ecx
xor edi, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
mov ecx, 1
mov dword [esp + 0x2a8], ecx
mov ebx, 7
xor edx, edx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], edi
mov word [esp + 0x44], dx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov word [esi + 4], dx
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], edi
mov word [esp + 0x60], cx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
mov word [esp + 0x28], dx
mov byte [esp + 0x2a8], 4
mov ecx, dword [esp + 0x2b8]
mov ebp, 8
mov dword [esp + 0x14], 0x208
cmp dword [esp + 0x2cc], ebp
jae 0x10007834
lea ecx, [esp + 0x2b8]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x98]
push edx
push edi
push edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x100078ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], edi
mov word [esp + 0x7c], cx
push edi
push edi
lea edx, [esp + 0x28]
push edx
push 0x400
push eax
push edi
push 0x1300
mov byte [esp + 0x2c4], 5
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push edi
mov eax, 0x1002bacc
call fcn.10005d40
cmp dword [esp + 0x90], ebp
jb 0x100078dc
mov eax, dword [esp + 0x7c]
push eax
call fcn.10011720
add esp, 4
jmp 0x100078dc
lea eax, [esp + 0x94]
lea edx, [eax + 2]
jmp 0x100078c0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100078c0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x98]
call fcn.10005d40
cmp dword [esp + 0x3c], ebp
jb 0x100078ef
mov ecx, dword [esp + 0x28]
push ecx
call fcn.10011720
add esp, 4
xor edx, edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
mov word [esp + 0x28], dx
cmp dword [esp + 0x74], ebp
jb 0x10007911
mov eax, dword [esp + 0x60]
push eax
call fcn.10011720
add esp, 4
xor ecx, ecx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], edi
mov word [esp + 0x60], cx
cmp dword [esp + 0x58], ebp
jb 0x10007933
mov edx, dword [esp + 0x44]
push edx
call fcn.10011720
add esp, 4
xor eax, eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], edi
mov word [esp + 0x44], ax
cmp dword [esp + 0x2cc], ebp
jb 0x1000795b
mov ecx, dword [esp + 0x2b8]
push ecx
call fcn.10011720
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x288]
xor ecx, esp
call fcn.1001172b
add esp, 0x298
ret
Function at 0x10007990
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebp
push esi
xor ebp, ebp
mov eax, str.AskTb
push edi
mov dword [esp + 0x10], ebp
xor edi, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x100079a6
mov ecx, dword [esp + 0x2c]
sub eax, edx
mov edx, dword [esp + 0x28]
sar eax, 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
push 0x203
push ebp
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebp
jne 0x10007aec
mov edx, dword [esp + 0x10]
push ebp
push ebp
push ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebp
jne 0x10007aec
cmp dword [esp + 0x14], ebp
je 0x10007aec
mov eax, dword [esp + 0xc]
cmp eax, ebp
je 0x10007aec
add eax, 2
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10010aec
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x10007aec
mov eax, dword [esp + 0xc]
push ebx
push eax
push ebp
push edi
call fcn.10017160
mov ebx, dword [esp + 0x24]
dec ebx
add esp, 0xc
cmp ebx, ebp
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], ebp
jl 0x10007aeb
mov ecx, dword [esp + 0x10]
push ebp
push ebp
lea edx, [esp + 0x28]
push edx
push ebp
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x2c]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, 0x103
je 0x10007ae9
dec ebx
cmp esi, ebp
jne 0x10007ae3
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x10]
ja 0x10007ae3
mov eax, dword [esp + 0x24]
push eax
push edi
push str.AskTb
call fcn.1001231f
add esp, 0xc
test eax, eax
jne 0x10007ad1
mov ecx, dword [esp + 0x14]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x10]
lea eax, [edx + edx]
push eax
push ebp
push edi
call fcn.10017160
add esp, 0xc
cmp ebx, ebp
jge 0x10007a73
jmp 0x10007aeb
xor esi, esi
pop ebx
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x10007afb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebp
je 0x10007b08
push edi
call fcn.10011d08
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x10007b20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push esi
push edi
push 0x228
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
mov esi, ecx
mov edi, edx
call fcn.10017160
add esp, 0xc
mov dword [esp + 0xc], 0x22c
cmp dword [esi], ebx
jne 0x10007b80
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10007bdf
lea ecx, [esp + 0xc]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
mov ebx, eax
jmp 0x10007b80
mov ecx, str.Updater.exe
lea eax, [esp + 0x30]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007bb6
test dx, dx
je 0x10007bb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007bb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10007b90
xor eax, eax
jmp 0x10007bbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10007bd4
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
mov ebx, eax
test ebx, ebx
jne 0x10007b80
jmp 0x10007bdf
mov ecx, 0x8b
lea esi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x238]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1001172b
add esp, 0x230
ret
Function at 0x10007c00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x100288e8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov eax, dword [0x1003230c]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push str.MicrosoftInternet_ExplorerApproved_Extensions
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10007c9a
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.D4027C7F_154A_4066_A1AD_4243D8127440
push eax
mov dword [esp + 0x2c], 3
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007c8f
cmp dword [esp + 0x10], ebx
jbe 0x10007c8f
push str.Toolbar_is_in_a_enabled_state
call fcn.10001180
jmp 0x10007d49
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
push 0x2e
mov eax, str.MicrosoftWindowsCurrentVersionExtSettings_
lea esi, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], dx
call fcn.10005d40
push 0x26
mov eax, str.D4027C7F_154A_4066_A1AD_4243D8127440
mov ecx, esi
mov dword [esp + 0x48], ebx
call fcn.10005c60
mov ecx, dword [esp + 0x20]
mov esi, 8
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x34], esi
jae 0x10007ce6
lea ecx, [esp + 0x20]
lea eax, [esp + 0x18]
push eax
mov edx, edi
call fcn.1000f5c0
add esp, 4
test eax, eax
je 0x10007d39
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], esi
jae 0x10007d07
lea eax, [esp + 0x20]
push eax
push edi
call fcn.1000f7e0
add esp, 8
test eax, eax
jne 0x10007d39
push str.Failed_to_delete_the_Flags_reg_value
call fcn.10001180
add esp, 4
cmp dword [esp + 0x34], esi
jb 0x10007d35
mov ecx, dword [esp + 0x20]
push ecx
call fcn.10011720
add esp, 4
xor eax, eax
jmp 0x10007d51
cmp dword [esp + 0x34], esi
jb 0x10007d4c
mov edx, dword [esp + 0x20]
push edx
call fcn.10011720
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1001172b
add esp, 0x3c
ret
Function at 0x10007fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10028598
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x1003230c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, 7
xor eax, eax
xor edx, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov word [esp + 0x10], dx
lea edx, [esp + 0xc]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x54], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esp + 0x28], esp
mov word [esi + 4], ax
push ecx
mov eax, str.UILevel
call fcn.10005d40
mov ecx, dword [esp + 0x5c]
call fcn.10006950
mov eax, dword [esp + 0x30]
mov esi, 8
add esp, 0x20
cmp dword [esp + 0x24], esi
jae 0x1000805b
lea eax, [esp + 0x10]
push eax
call fcn.1001222a
add esp, 4
cmp eax, 5
je 0x1000808d
cmp eax, 4
je 0x1000808d
cmp eax, 3
je 0x1000808d
cmp dword [esp + 0x24], esi
jb 0x10008086
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10011720
add esp, 4
mov eax, 1
jmp 0x100080a2
cmp dword [esp + 0x24], esi
jb 0x100080a0
mov edx, dword [esp + 0x10]
push edx
call fcn.10011720
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1001172b
add esp, 0x30
ret
Function at 0x10009800
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebp
push esi
push 0
push 0
mov esi, eax
call ebx
mov ebp, eax
test ebp, ebp
jbe 0x100098a0
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.10010aec
add esp, 4
mov edi, eax
push edi
push ebp
call ebx
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009843
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.10005d40
push edi
call fcn.10011d08
add esp, 4
push 7
mov eax, str.APNLogs
mov ecx, esi
call fcn.10005c60
cmp dword [esi + 0x18], 8
pop edi
jb 0x1000987d
mov esi, dword [esi + 4]
jmp 0x10009880
add esi, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jg 0x1000989a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100098a0
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x1000cca0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10027cbb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1003230c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10011040
push 4
mov dword [esp + 0x20], 0
call fcn.10011f5e
mov edi, eax
add esp, 4
test edi, edi
je 0x1000cd1e
call fcn.10010eb1
mov dword [edi], eax
call fcn.10010cdf
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.10011001
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1000cd13
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.10011029
jmp 0x1000cd20
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x1000f510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push str.DataDir
push edx
call esi
test eax, eax
jne 0x1000f5a1
mov eax, dword [esp + 0xc]
add eax, 2
push edi
push eax
call fcn.10010aec
add esp, 4
lea ecx, [esp + 0x10]
push ecx
mov edi, eax
mov eax, dword [ebp]
push edi
lea edx, [esp + 0x1c]
push edx
push ebx
push str.DataDir
push eax
call esi
test eax, eax
jne 0x1000f597
cmp dword [esp + 0x14], 1
jne 0x1000f597
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000f577
mov esi, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.10005d40
mov ebx, 1
push edi
call fcn.10011d08
add esp, 4
pop edi
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x1000f5c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 4]
push eax
push 0x20019
xor edi, edi
push edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000f5e4
xor eax, eax
pop edi
add esp, 0xc
ret
mov edx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push str.Flags
push edx
call esi
test eax, eax
jne 0x1000f63e
mov eax, 4
cmp dword [esp + 0x10], eax
jne 0x1000f63e
cmp dword [esp + 0xc], eax
jne 0x1000f63e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.Flags
push eax
call esi
test eax, eax
jne 0x1000f63e
lea edi, [eax + 1]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
add esp, 0xc
ret
Function at 0x1000f7e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x21c]
mov dword [esp + 0x10], esi
test ebx, ebx
je 0x1000f8e3
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1000f8e3
lea eax, [esp + 8]
push eax
push 0x10008
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000f8e8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push eax
mov dword [esp + 0x30], 0xff
call edi
mov esi, eax
cmp esi, 0x103
je 0x1000f8b0
test esi, esi
jne 0x1000f8be
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.1000f7e0
mov esi, eax
add esp, 8
test esi, esi
je 0x1000f842
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1001172b
add esp, 0x210
ret
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1001172b
add esp, 0x210
ret
mov eax, 0x3f2
mov ecx, dword [esp + 0x214]
pop esi
pop ebx
xor ecx, esp
call fcn.1001172b
add esp, 0x210
ret
Function at 0x1000f900
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x668
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x664], eax
push ebx
push ebp
mov ebp, dword [esp + 0x674]
push esi
push edi
mov edx, ebp
lea ecx, [esp + 0x468]
call fcn.10006500
push 0x1002de24
lea eax, [esp + 0x46c]
call fcn.10006560
mov edx, ebp
lea ecx, [esp + 0x260]
call fcn.10006500
push 0x1002be74
lea eax, [esp + 0x264]
call fcn.10006560
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000fa80
lea edx, [esp + 0x260]
lea ecx, [esp + 0x468]
call fcn.10006500
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ebx, [ebx]
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
je 0x1000fa6e
lea eax, [esp + 0x3c]
push 0x1002de08
push eax
call fcn.10012181
add esp, 8
test eax, eax
je 0x1000f9a0
lea ecx, [esp + 0x3c]
push 0x1002de0c
push ecx
call fcn.10012181
add esp, 8
test eax, eax
je 0x1000f9a0
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x264]
call fcn.10006560
mov al, byte [esp + 0x10]
test al, 0x10
je 0x1000fa2b
lea eax, [esp + 0x260]
push eax
call fcn.1000f900
add esp, 4
test al, al
je 0x1000fa79
lea ecx, [esp + 0x260]
push ecx
call ebx
lea edx, [esp + 0x468]
lea ecx, [esp + 0x260]
call fcn.10006500
jmp 0x1000f9a0
test al, 1
je 0x1000fa44
lea edx, [esp + 0x260]
push 0x80
push edx
call fcn.100123c5
add esp, 8
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1000fa79
lea edx, [esp + 0x468]
lea ecx, [esp + 0x260]
call fcn.10006500
jmp 0x1000f9a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1000fa84
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x1000fa97
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call ebx
xor ecx, ecx
test eax, eax
setg cl
mov al, cl
mov ecx, dword [esp + 0x674]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001172b
add esp, 0x668
ret

Function at 0x1001172b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003230c]
jne 0x10011735
repz ret
jmp fcn.1001720c

Function at 0x100123c5
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x100123f6
call fcn.1001440f
mov dword [eax], esi
call fcn.100143fc
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10011cd2
add esp, 0x14
or eax, 0xffffffff
jmp 0x10012431
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10012413
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10014422
pop ecx
jmp 0x100123f1
test byte [ebp + 0xc], 0x80
je 0x1001241e
and eax, 0xfffffffe
jmp 0x10012421
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10012404
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100248e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100182a8
and dword [ebp - 4], 0
cmp dword [0x10034554], 0
mov ebx, eax
jne 0x1002499a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10024a4b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10024a4b
push eax
call fcn.10018236
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10034554], eax
call esi
push eax
call fcn.10018236
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10034558], eax
call esi
push eax
call fcn.10018236
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003455c], eax
call esi
push eax
call fcn.10018236
pop ecx
mov dword [0x10034564], eax
test eax, eax
je 0x1002499a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10018236
pop ecx
mov dword [0x10034560], eax
mov eax, dword [0x10034560]
cmp eax, ebx
je 0x100249f2
cmp dword [0x10034564], ebx
je 0x100249f2
push eax
call fcn.100182b1
push dword [0x10034564]
mov esi, eax
call fcn.100182b1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100249f2
test edi, edi
je 0x100249f2
call esi
test eax, eax
je 0x100249e9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100249e9
test byte [ebp - 0xc], 1
jne 0x100249f2
or dword [ebp + 0x10], 0x200000
jmp 0x10024a2b
mov eax, dword [0x10034558]
cmp eax, ebx
je 0x10024a2b
push eax
call fcn.100182b1
pop ecx
test eax, eax
je 0x10024a2b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10024a2b
mov eax, dword [0x1003455c]
cmp eax, ebx
je 0x10024a2b
push eax
call fcn.100182b1
pop ecx
test eax, eax
je 0x10024a2b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10034554]
call fcn.100182b1
pop ecx
test eax, eax
je 0x10024a4b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10024a4d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret