joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100031e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x248], str.Word
mov dword [ebp - 0x18c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x190], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x254]
cmp dword [eax + 4], 0
je 0x1000324f
mov ecx, dword [ebp - 0x254]
mov edx, dword [ecx + 4]
push edx
push 0
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x254]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x254]
mov dword [eax + 0x7d4], 0
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x250], 1
jmp 0x10003291
mov ecx, dword [ebp - 0x250]
add ecx, 1
mov dword [ebp - 0x250], ecx
cmp dword [ebp - 0x250], 0xa
jge 0x10003321
cmp dword [ebp - 0x244], 0xffffffff
jne 0x10003321
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov edx, dword [ebp - 0x254]
add edx, 0x4dc
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x248]
push eax
lea ecx, [ebp - 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x248]
push edx
lea eax, [ebp - 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x244], 0xffffffff
jne 0x1000331c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x250]
imul ecx, ecx, 0x7d0
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10003282
cmp dword [ebp - 0x244], 0xffffffff
jne 0x1000333a
mov eax, 0xc
jmp 0x1000346a
push 0
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.GDI32.dll_GetBkMode]
cmp dword [ebp - 0xec], 0
ja 0x1000336f
mov eax, 0x12
jmp 0x1000346a
mov ecx, dword [ebp - 0xec]
and ecx, 0xfffff
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xec]
add edx, 1
push edx
push 8
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp - 0x254]
mov dword [edx + 4], eax
push 0
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0xec]
push ecx
mov edx, dword [ebp - 0x254]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000340d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xd
jmp 0x1000346a
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x24c]
mov byte [ecx + edx], 0
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
movzx eax, ax
mov dword [ebp - 0x190], eax
mov ecx, 0x3d
sub ecx, dword [ebp - 0xf4]
imul ecx, dword [ebp - 0x190]
mov dword [ebp - 0x190], ecx
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xec]
mov dword [eax + 0x7d4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100047b0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov dword [ebp - 0x140], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x128], str.Word
mov dword [ebp - 0x124], 0
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_GetBkColor]
mov eax, dword [ebp - 0x140]
add eax, 0x4dc
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x140]
add edx, 0x4dc
push edx
mov ecx, dword [ebp - 0x140]
call fcn.10004150
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x10004887
mov eax, dword [ebp - 0x124]
jmp 0x10004946
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 0x140]
add eax, 0x4dc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffff
jne 0x100048c4
mov eax, 0xc
jmp 0x10004946
mov dword [ebp - 0x12c], 0
push 0
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x140]
mov eax, dword [edx + 0x7d4]
push eax
mov ecx, dword [ebp - 0x140]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10004906
mov eax, 0x1b
jmp 0x10004946
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x124]
jmp 0x10004946
mov esp, ebp
pop ebp
ret
Function at 0x10004fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov dword [ebp - 0x864], ecx
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x1a4], str.String
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0x18c], 0
push 0x10
lea eax, [ebp - 0x19c]
push eax
call fcn.1000f930
add esp, 8
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp - 0x180], ecx
lea edx, [ebp - 0x180]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [ebp - 0x178], al
push 0x44
lea eax, [ebp - 0x4f0]
push eax
call fcn.1000f930
add esp, 8
mov ecx, dword [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x184], 0
lea eax, [ebp - 0x180]
push eax
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x4f0], 0x44
lea edx, [ebp - 0x180]
push edx
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x188], 0
lea ecx, [ebp - 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xe4], eax
push 0
push 0x1001a014
lea ecx, [ebp - 0x4a8]
call fcn.10001980
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0
je 0x1000525b
mov edx, dword [ebp - 0x1a4]
push edx
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x184]
push ecx
mov edx, dword [ebp - 0x4f4]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x184]
push eax
push 1
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4fc], eax
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.GDI32.dll_GetBkColor]
lea edx, [ebp - 0x4f8]
push edx
push 0x2000000
mov eax, dword [ebp - 0x4fc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100051e6
lea ecx, [ebp - 0x19c]
push ecx
lea edx, [ebp - 0x4f0]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push str.___tLk
lea ecx, [ebp - 0x800]
call fcn.10001980
push eax
push 0
mov eax, dword [ebp - 0x4f8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [ebp - 0x188], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x188], 0
je 0x100051dc
mov dword [ebp - 0x868], str.succeed
jmp 0x100051e6
mov dword [ebp - 0x868], str.failed
cmp dword [ebp - 0x188], 0
jne 0x1000522b
lea ecx, [ebp - 0x19c]
push ecx
lea edx, [ebp - 0x4f0]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push str.___tLk
lea ecx, [ebp - 0x800]
call fcn.10001980
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x188], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x188], 0
je 0x10005246
mov dword [ebp - 0x86c], str.succeed
jmp 0x10005250
mov dword [ebp - 0x86c], str.failed
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x864]
call fcn.100041b0
mov esp, ebp
pop ebp
ret
Function at 0x10009df0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp + 8]
add eax, 0x4dc
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x10c], 0x2e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x10b], 0x65
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x10a], 0x78
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x109], 0x65
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x4dc
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x10009ec0
mov dword [ebp - 0x11c], 0xe
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.GDI32.dll_GetBkColor]
cmp dword [ebp - 0x11c], 0
jne 0x10009ef0
push 0
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x120]
call fcn.1000c760
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x110]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x11c]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ab40
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x52c]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x1000abf6
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x114], edx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_EqualRect]
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x125], al
movzx eax, byte [ebp - 0x125]
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
mov dword [ebp - 0x104], eax
jmp 0x1000ac4b
lea ecx, [ebp - 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xfc], eax
push 0x400
lea edx, [ebp - 0x528]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.WinInit.Ini
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x528]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x1001744c
push str.Rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x104]
jmp 0x1000ac60
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ac70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
mov dword [ebp - 0x598], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x584], str.Forth
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x58c], 0
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x598]
movzx ecx, byte [eax + 0x1c]
test ecx, ecx
je 0x1000acee
lea edx, [ebp - 0x470]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x1000ad00
push 0x400
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x584]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 1]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x474]
push ecx
call dword [sym.imp.GDI32.dll_GetBkMode]
lea edx, [ebp - 0x580]
push edx
mov ecx, dword [ebp - 0x598]
call fcn.1000a9e0
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
add eax, dword [ebp - 0x594]
mov dword [ebp - 0x478], eax
push 0x10017460
lea ecx, [ebp - 0x470]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x580]
push edx
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x470]
push ecx
mov edx, dword [ebp - 0x598]
mov eax, dword [edx + 0x18e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1000adb4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp ecx, 0xa
jl 0x1000ad1e
lea eax, [ebp - 0x470]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x598]
call fcn.1000a8a0
movzx edx, al
test edx, edx
jne 0x1000add8
mov eax, 5
jmp 0x1000adf4
lea eax, [ebp - 0x470]
push eax
mov ecx, dword [ebp - 0x598]
add ecx, 0x18e8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ae00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0x104
push 0x1001a094
mov ecx, dword [ebp - 0x2a4]
add ecx, 0x128
call fcn.10001980
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x130], 0x80000002
cmp dword [ebp - 0x254], 0
je 0x1000ae75
mov eax, dword [ebp - 0x254]
push eax
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetBkMode]
push 0x1001a34c
mov ecx, dword [ebp - 0x2a4]
add ecx, 0x128
call fcn.10001980
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], 1
mov dword [ebp - 0x278], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x27c]
push edx
mov eax, dword [ebp - 0x280]
push eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x278], eax
xor eax, eax
cmp dword [ebp - 0x278], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x1000aefc
xor al, al
jmp 0x1000af93
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10001e00
add esp, 8
mov dword [ebp - 0x124], eax
push 0x1001a358
mov ecx, dword [ebp - 0x2a4]
add ecx, 0x128
call fcn.10001980
push eax
mov ecx, dword [ebp - 0x124]
push ecx
push str._d_s
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.10001e00
add esp, 8
cmp eax, 0xc4b3293
jne 0x1000af7a
mov al, 1
jmp 0x1000af93
xor al, al
jmp 0x1000af93
mov esp, ebp
pop ebp
ret
Function at 0x1000b390
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x918
mov dword [ebp - 0x918], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x5ac], 0
mov dword [ebp - 0x5a4], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x5a0], str.Forth
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x918]
mov ecx, dword [eax + 0x18e4]
push ecx
mov ecx, dword [ebp - 0x918]
call fcn.1000bd30
mov dword [ebp - 0x294], eax
mov edx, dword [ebp - 0x294]
push edx
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x290]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x294], 0
mov edx, dword [ebp - 0x918]
movzx eax, byte [edx + 8]
test eax, eax
je 0x1000b564
lea ecx, [ebp - 0xf0]
push ecx
lea edx, [ebp - 0x188]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
push eax
push 0x100172a0
lea ecx, [ebp - 0xf0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x1001a104
lea ecx, [ebp - 0x598]
call fcn.10001980
push eax
lea edx, [ebp - 0x7c0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x5a0]
movsx ecx, byte [eax]
push ecx
mov edx, dword [ebp - 0xf4]
push edx
lea eax, [ebp - 0x5b0]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
lea ecx, [ebp - 0x290]
push ecx
lea edx, [ebp - 0x7c0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
movzx eax, ax
mov dword [ebp - 0xf4], eax
mov ecx, 0x3d
sub ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0xf4]
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x5b8], 0x80000002
lea edx, [ebp - 0x7c0]
test edx, edx
je 0x1000b51e
lea eax, [ebp - 0x7c0]
push eax
lea ecx, [ebp - 0x6b8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x8ec], 0
lea edx, [ebp - 0x6b8]
push edx
mov eax, dword [ebp - 0x5b8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 0x8ec], eax
xor ecx, ecx
cmp dword [ebp - 0x8ec], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x1000b55f
mov dword [ebp - 0x59c], 9
jmp 0x1000b5e6
push 0x1001a254
lea ecx, [ebp - 0x598]
call fcn.10001980
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x7c8], 0x80000002
cmp dword [ebp - 0x910], 0
je 0x1000b5a1
mov eax, dword [ebp - 0x910]
push eax
lea ecx, [ebp - 0x8c8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x914], 0
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x8c8]
push eax
mov ecx, dword [ebp - 0x7c8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov dword [ebp - 0x914], eax
xor edx, edx
cmp dword [ebp - 0x914], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x1000b5e6
mov eax, 9
jmp 0x1000b5ec
mov eax, dword [ebp - 0x59c]
mov esp, ebp
pop ebp
ret
Function at 0x1000d2a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x198], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x190], str.Forth
mov dword [ebp - 0x18c], 0x10017270
mov dword [ebp - 0x194], 0
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
add eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x184], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x188], 0xffffffff
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x188], eax
mov edx, dword [ebp - 0xec]
push edx
call dword [sym.imp.GDI32.dll_GetBkMode]
cmp dword [ebp - 0x188], 0xffffffff
jne 0x1000d3c1
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 1]
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1000d3ad
mov eax, dword [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x16
jmp 0x1000d40e
mov ecx, dword [ebp - 0x188]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xc
jmp 0x1000d40e
push 0
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x190]
push eax
lea ecx, [ebp - 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
jmp 0x1000d40e
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], str.Forth
xor eax, eax
mov word [ebp - 0x30], ax
xor ecx, ecx
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov word [ebp - 0x22], cx
xor edx, edx
mov word [ebp - 0x20], dx
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x80], 3
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x100]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x7c], eax
xor eax, eax
cmp dword [ebp - 0x7c], 0
sete al
movzx ecx, al
test ecx, ecx
je 0x1000d599
lea edx, [ebp - 0xc]
push edx
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_GetBkMode]
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x38]
movsx ecx, byte [eax]
push ecx
mov edx, dword [ebp - 0x34]
push edx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x68]
sub edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x64]
sbb eax, dword [ebp - 0x6c]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov ecx, 0x23c34600
mul ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x4c]
jl 0x1000d593
jg 0x1000d58d
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x50]
jbe 0x1000d593
mov al, 1
jmp 0x1000d59b
xor al, al
jmp 0x1000d59b
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d5b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov dword [ebp - 0x204], ecx
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1e8], eax
lea ecx, [ebp - 0x1e8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [ebp - 0x1e0], al
mov dword [ebp - 0x100], 0x10
lea edx, [ebp - 0x1f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x200], 0
push 0x10
lea eax, [ebp - 0x1f8]
push eax
push 3
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x100]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0x200], eax
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xfc], eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1000e110
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push str._b_u_tY6
mov ecx, dword [ebp - 0x54]
add ecx, 0x128
call fcn.10001980
push str._b_u_tY6
mov ecx, dword [ebp - 0x54]
add ecx, 0x128
call fcn.10001980
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 0x54]
mov dword [ecx + 0x19ec], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xb7
je 0x1000e180
cmp dword [ebp - 0x10], 5
jne 0x1000e1a1
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
movzx edx, ax
mov dword [ebp - 0xc], edx
mov eax, 0x3d
sub eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov al, 1
jmp 0x1000e1a3
xor al, al
mov esp, ebp
pop ebp
ret