joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d2c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101092ed
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov ecx, dword [0x1013ba54]
cmp ecx, ebx
jne 0x1003d32a
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x1003d319
mov esi, eax
call fcn.10011610
jmp 0x1003d31b
xor eax, eax
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], ecx
lea edx, [ebp - 0x64]
call fcn.10011d50
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.1004ce20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], esi
jb 0x1003d36b
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x54], ebx
je 0x1003d3b7
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], esi
jae 0x1003d37b
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1003d3b7
push 0xffffffffffffffff
xor ecx, ecx
push ebx
lea edx, [ebp - 0x64]
mov word [ebp - 0x2c], cx
mov esi, 7
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
call fcn.1000b050
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ebx, [esi - 6]
jmp 0x1003d3e5
push ebx
xor eax, eax
mov esi, 7
push 0x101134e8
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
call fcn.1000abb0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 4
mov ebx, 2
xor ecx, ecx
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], 0
mov word [edi], cx
push eax
mov ecx, edi
mov dword [ebp - 0x68], ebx
call fcn.10009ca0
or ebx, 4
test bl, 2
je 0x1003d42c
and ebx, 0xfffffffd
cmp dword [ebp - 0x34], 8
jb 0x1003d41c
mov edx, dword [ebp - 0x48]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
test bl, 1
je 0x1003d453
cmp dword [ebp - 0x18], 8
jb 0x1003d443
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
cmp dword [ebp - 0x50], 8
jb 0x1003d465
mov eax, dword [ebp - 0x64]
push eax
call fcn.10065453
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1003e2e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10108fad
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x68], esi
mov edi, dword [0x1013ba54]
mov dword [ebp - 0x6c], eax
cmp edi, esi
jne 0x1003e351
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x1003e340
mov esi, eax
call fcn.10011610
jmp 0x1003e342
xor eax, eax
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x64]
call fcn.10011900
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.1004cdc0
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], esi
jb 0x1003e394
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x54], ebx
je 0x1003e3e0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], esi
jae 0x1003e3a4
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1003e3e0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x64]
xor edx, edx
mov edi, 7
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
call fcn.1000b050
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ebx, [edi - 6]
jmp 0x1003e40e
xor ecx, ecx
push ebx
mov word [ebp - 0x48], cx
mov edi, 7
push 0x101134e8
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
call fcn.1000abb0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 4
mov ebx, 2
mov esi, dword [ebp - 0x6c]
xor edx, edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov dword [ebp - 0x68], ebx
mov word [esi], dx
call fcn.10009ca0
or ebx, 4
test bl, 2
je 0x1003e458
and ebx, 0xfffffffd
cmp dword [ebp - 0x34], 8
jb 0x1003e448
mov eax, dword [ebp - 0x48]
push eax
call fcn.10065453
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], cx
test bl, 1
je 0x1003e47f
cmp dword [ebp - 0x18], 8
jb 0x1003e46f
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x50], 8
jb 0x1003e491
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10065453
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1003f0c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010dd18
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
cmp dword [esi + 0x14], ebx
je 0x1003f1e5
cmp dword [esi + 0x30], ebx
je 0x1003f1e5
cmp dword [esi + 0x30], ebx
lea edi, [esi + 0x20]
je 0x1003f12b
cmp dword [edi + 0x14], 8
jb 0x1003f119
mov eax, dword [edi]
jmp 0x1003f11b
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
jne 0x1003f134
push edi
call fcn.1000d470
add esp, 4
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 4], ebx
push ebx
xor edx, edx
mov edi, 7
push 0x101134e8
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], dx
call fcn.1000abb0
mov byte [ebp - 4], 1
push 0xd
xor eax, eax
push str.QQBrowser.exe
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
call fcn.1000abb0
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.100166c0
add esp, 4
cmp dword [ebp - 0x1c], 8
jb 0x1003f1a6
mov edx, dword [ebp - 0x30]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov byte [ebp - 4], bl
cmp dword [ebp - 0x50], 8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
jb 0x1003f1c7
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10065453
add esp, 4
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
push edx
mov edx, esi
call fcn.1003ebd0
mov eax, dword [ebp - 0x48]
cmp eax, ebx
je 0x1003f1e5
push eax
call fcn.10065453
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret 4
Function at 0x10043c10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10106eb2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10137920]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], 0x10127574
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], 1
call fcn.100339ff
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], 0x10127570
mov ecx, esi
call fcn.1000ff20
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x1013b828]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, dword [ebp + 0xc]
push 0x40
push 2
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10043460
test eax, eax
jne 0x10043d07
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x10043d00
or eax, 4
push ebx
push eax
call fcn.100113e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100464e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101092ed
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov ecx, dword [0x1013ba54]
cmp ecx, ebx
jne 0x1004654a
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x10046539
mov esi, eax
call fcn.10011610
jmp 0x1004653b
xor eax, eax
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], ecx
lea edx, [ebp - 0x64]
call fcn.10011d50
push 1
push 0x1012329c
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 1
call fcn.10009ff0
lea esi, [ebp - 0x2c]
call fcn.10054750
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], esi
jb 0x1004659a
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x54], ebx
je 0x100465e6
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], esi
jae 0x100465aa
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x100465e6
push 0xffffffffffffffff
xor ecx, ecx
push ebx
lea edx, [ebp - 0x64]
mov word [ebp - 0x2c], cx
mov esi, 7
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
call fcn.1000b050
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ebx, [esi - 6]
jmp 0x10046614
push ebx
xor eax, eax
mov esi, 7
push 0x101134e8
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
call fcn.1000abb0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 4
mov ebx, 2
xor ecx, ecx
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], 0
mov word [edi], cx
push eax
mov ecx, edi
mov dword [ebp - 0x68], ebx
call fcn.10009ca0
or ebx, 4
test bl, 2
je 0x1004665b
and ebx, 0xfffffffd
cmp dword [ebp - 0x34], 8
jb 0x1004664b
mov edx, dword [ebp - 0x48]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
test bl, 1
je 0x10046682
cmp dword [ebp - 0x18], 8
jb 0x10046672
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
cmp dword [ebp - 0x50], 8
jb 0x10046694
mov eax, dword [ebp - 0x64]
push eax
call fcn.10065453
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x100477a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10108fad
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x68], esi
mov edi, dword [0x1013ba54]
mov dword [ebp - 0x6c], eax
cmp edi, esi
jne 0x10047811
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x10047800
mov esi, eax
call fcn.10011610
jmp 0x10047802
xor eax, eax
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x64]
call fcn.10011900
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.1004cd00
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], esi
jb 0x10047854
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x54], ebx
je 0x100478a0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], esi
jae 0x10047864
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x100478a0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x64]
xor edx, edx
mov edi, 7
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
call fcn.1000b050
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ebx, [edi - 6]
jmp 0x100478ce
xor ecx, ecx
push ebx
mov word [ebp - 0x48], cx
mov edi, 7
push 0x101134e8
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
call fcn.1000abb0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 4
mov ebx, 2
mov esi, dword [ebp - 0x6c]
xor edx, edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov dword [ebp - 0x68], ebx
mov word [esi], dx
call fcn.10009ca0
or ebx, 4
test bl, 2
je 0x10047918
and ebx, 0xfffffffd
cmp dword [ebp - 0x34], 8
jb 0x10047908
mov eax, dword [ebp - 0x48]
push eax
call fcn.10065453
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], cx
test bl, 1
je 0x1004793f
cmp dword [ebp - 0x18], 8
jb 0x1004792f
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x50], 8
jb 0x10047951
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10065453
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x10047b10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010e091
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x140], eax
cmp dword [edi + 0x14], ebx
je 0x10047cd7
cmp dword [edi + 0x30], ebx
je 0x10047cd7
cmp dword [edi + 0x30], ebx
lea esi, [edi + 0x20]
je 0x10047b81
cmp dword [esi + 0x14], 8
jb 0x10047b6f
mov eax, dword [esi]
jmp 0x10047b71
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
jne 0x10047b8a
push esi
call fcn.1000d470
add esp, 4
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 4], ebx
xor ecx, ecx
push ebx
mov word [ebp - 0x16c], cx
mov esi, 7
push 0x101134e8
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x15c], ebx
call fcn.1000abb0
mov byte [ebp - 4], 1
push 0x10
xor edx, edx
push str.2345Explorer.exe
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], dx
call fcn.1000abb0
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x16c]
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 2
call fcn.100166c0
add esp, 4
cmp dword [ebp - 0x1c], 8
jb 0x10047c17
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x158], 8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], dx
jb 0x10047c3e
mov eax, dword [ebp - 0x16c]
push eax
call fcn.10065453
add esp, 4
lea ecx, [ebp - 0x4c]
push ecx
call fcn.10047ef0
add esp, 4
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.10049050
cmp eax, 8
jl 0x10047c9a
lea edi, [ebp - 0x13c]
call fcn.1004d590
xor edx, edx
mov dword [ebp - 0x13c], 0x10128394
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], ebx
mov word [ebp - 0x6c], dx
mov ecx, dword [ebp - 0x140]
mov eax, edi
push eax
mov byte [ebp - 4], 4
call fcn.10054a30
mov ecx, edi
call fcn.100549e0
jmp 0x10047ca6
mov ecx, dword [ebp - 0x140]
push edi
call fcn.10049190
cmp dword [ebp - 0x38], 8
jb 0x10047cb8
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.10065453
add esp, 4
mov eax, dword [ebp - 0x150]
xor edx, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], dx
cmp eax, ebx
je 0x10047cd7
push eax
call fcn.10065453
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret 4
Function at 0x10047d00
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d158
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10
mov ebx, ecx
xor eax, eax
mov edi, 7
xor esi, esi
push str.2345Explorer.exe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
call fcn.1000abb0
sub esp, 0x1c
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x84], esp
push esi
xor edx, edx
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], esi
push 0x101134e8
mov word [ecx], dx
call fcn.1000abb0
lea esi, [ebp - 0x2c]
call fcn.1004e6b0
mov edi, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], edi
jb 0x10047d98
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
lea esi, [ebp - 0x2c]
call fcn.1004d060
lea ecx, [ebx + 4]
mov edx, eax
mov dword [ebp - 4], 1
call fcn.1004da50
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], edi
jb 0x10047dc9
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
lea esi, [ebp - 0x2c]
call fcn.1004d060
cmp dword [ebx + 0xe0], edi
mov esi, eax
lea eax, [ebx + 0xcc]
jb 0x10047de3
mov eax, dword [eax]
lea edx, [ebp - 0x84]
push edx
push 2
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10047e20
cmp dword [esi + 0x14], edi
jb 0x10047e05
mov esi, dword [esi]
mov eax, dword [ebp - 0x84]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x84]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], edi
jb 0x10047e31
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
lea esi, [ebp - 0x80]
call fcn.1004d060
mov esi, eax
push 0x1012329c
add ebx, 0x20
lea eax, [ebp - 0x64]
push ebx
push eax
mov dword [ebp - 4], 2
call fcn.10010100
add esp, 0xc
push esi
push eax
lea ecx, [ebp - 0x48]
push ecx
mov byte [ebp - 4], 3
call fcn.10010440
add esp, 0xc
xor esi, esi
push esi
push eax
mov byte [ebp - 4], 4
call fcn.1000d6f0
add esp, 8
cmp dword [ebp - 0x34], edi
jb 0x10047e8a
mov edx, dword [ebp - 0x48]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov ebx, 7
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], ax
cmp dword [ebp - 0x50], edi
jb 0x10047eac
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], esi
mov word [ebp - 0x64], dx
cmp dword [ebp - 0x6c], edi
jb 0x10047ec9
mov eax, dword [ebp - 0x80]
push eax
call fcn.10065453
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1004c590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101092ed
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov ecx, dword [0x1013ba54]
cmp ecx, ebx
jne 0x1004c5fa
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x1004c5e9
mov esi, eax
call fcn.10011610
jmp 0x1004c5eb
xor eax, eax
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x1013ba54], ecx
lea edx, [ebp - 0x64]
call fcn.10011d50
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.1004cd60
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.1000a320
mov esi, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], esi
jb 0x1004c63b
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
cmp dword [ebp - 0x54], ebx
je 0x1004c687
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], esi
jae 0x1004c64b
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1004c687
push 0xffffffffffffffff
xor ecx, ecx
push ebx
lea edx, [ebp - 0x64]
mov word [ebp - 0x2c], cx
mov esi, 7
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
call fcn.1000b050
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ebx, [esi - 6]
jmp 0x1004c6b5
push ebx
xor eax, eax
mov esi, 7
push 0x101134e8
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
call fcn.1000abb0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 4
mov ebx, 2
xor ecx, ecx
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], 0
mov word [edi], cx
push eax
mov ecx, edi
mov dword [ebp - 0x68], ebx
call fcn.10009ca0
or ebx, 4
test bl, 2
je 0x1004c6fc
and ebx, 0xfffffffd
cmp dword [ebp - 0x34], 8
jb 0x1004c6ec
mov edx, dword [ebp - 0x48]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
test bl, 1
je 0x1004c723
cmp dword [ebp - 0x18], 8
jb 0x1004c713
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
cmp dword [ebp - 0x50], 8
jb 0x1004c735
mov eax, dword [ebp - 0x64]
push eax
call fcn.10065453
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret