joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d44
Capabilities:
Copy file
Delete file
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x694
push ebx
push esi
push edi
push 0x80
push 0x40000000
push 0x1008518
call fcn.0100254b
test eax, eax
jl 0x1002f87
push 0x1008da0
push 0x10016ac
mov ebx, 0x104
push 0x10016a0
lea eax, [ebp - 0x284]
xor esi, esi
push ebx
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
cmp word [0x1008da0], si
je 0x1002ec5
lea eax, [ebp - 0x18]
mov edi, 0x20019
push eax
push edi
lea eax, [ebp - 0x284]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x1002ec5
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0x10017f4
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x1002ebc
lea eax, [ebp - 0x694]
push eax
push 0x1008308
call fcn.010025e2
test eax, eax
jl 0x1002eae
push 0x32
lea ecx, [ebp - 0x14]
pop ebx
xor eax, eax
push ecx
lea ecx, [ebp - 0x284]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push eax
push ecx
lea ecx, [ebp - 0x7c]
mov edi, 0x208
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
call esi
test eax, eax
jne 0x1002eae
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x48c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x48c]
push 0
push eax
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1002ea0
lea eax, [ebp - 0x14]
inc dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x14], edi
push dword [ebp - 8]
jmp 0x1002e2e
push 0x76
call fcn.010024c7
mov dword [ebp - 4], 0x80004005
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x104
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
push 1
pop edi
mov esi, 0x1008760
jl 0x1002f6a
cmp dword [0x1008968], edi
je 0x1002f06
lea eax, [ebp - 0x284]
push 0x1001738
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x284]
push eax
push 0x1008308
push esi
call fcn.01002650
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x1002f6a
cmp word [0x1008da0], 0
je 0x1002f6a
push 0x1008518
call dword [sym.imp.SHELL32.dll_IsLFNDriveW]
test eax, eax
push ebx
je 0x1002f2d
push 0x10017b0
jmp 0x1002f32
push 0x100177c
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [0x1008968], edi
mov eax, 0x1008990
je 0x1002f52
lea eax, [ebp - 0x284]
push 0x1008518
push 0x1008b98
push eax
push 0x1008da0
call fcn.01002c5e
mov dword [ebp - 4], eax
cmp dword [0x1008968], edi
je 0x1002f79
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 4], 0
jl 0x1002f87
push 0
push edi
call fcn.010030f2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10030d9
Capabilities:
Set file attributes

Disassembly:
push 6
push 0x1008518
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x1008308
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
ret

Function at 0x10030f2
Capabilities:
Set file attributes

Disassembly:
call fcn.010030d9
cmp dword [esp + 4], 0
jne 0x1003110
cmp dword [esp + 8], 0
je 0x1003110
push dword [esp + 8]
call fcn.01003010
jmp 0x100311d
push 6
push 0x1008760
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x1008518
push 0x1001844
push 0x1001828
push 0x1001618
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
ret 8

Function at 0x100313a
Capabilities:
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x1008990
push edi
call fcn.0100321c
test eax, eax
jne 0x1003155
push edi
call fcn.010033cb
xor ebp, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0x80
push ebp
push esi
push 3
push ebp
push ebp
push 0x80000000
push edi
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x10031d1
push esi
push 0x1008760
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
push esi
push 2
push ebp
push ebp
push 0x40000000
push 0x1008760
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10031ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10031d1
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebp
jne 0x10031d5
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
xor eax, eax
jmp 0x1003215
lea eax, [esp + 0x14]
push ebp
push eax
push dword [esp + 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x14]
push ebp
push eax
push dword [esp + 0x18]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push edi
call esi
push ebx
call esi
push 1
pop eax
mov dword [0x10082f4], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x100321c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 4
Function at 0x1003233
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 1
pop esi
mov edi, 0x1008760
xor ebx, ebx
push 0x80
push edi
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x540
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 0x1001848
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10032ca
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
jne 0x10032bf
push esi
push ebx
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1003284
cmp dword [ebp - 0x18], 0xf
jne 0x100329b
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100329b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10032cf
call fcn.010032e5
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHRegisterValidateTemplate]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10032e5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
push edi
lea eax, [ebp - 0x278]
push 0x104
push eax
push 0x6c
push dword [0x10080e0]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x278]
push 0x1008760
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
xor esi, esi
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x70], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x6c], esi
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push 0x20
push 1
push esi
lea eax, [ebp - 0x278]
push esi
push eax
push esi
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x3e], si
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, 0xff
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push esi
push eax
push 1
call edi
cmp eax, 1
jne 0x10033bd
push 1
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x10033b1
cmp dword [ebp - 0x28], 0xf
jne 0x100338c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100338c
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push esi
push eax
push 1
jmp 0x1003385
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10033cb
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x104
lea eax, [ebp - 0x214]
push edi
push eax
push 0x7a
push dword [0x10080e0]
call esi
xor ebx, ebx
push 2
lea eax, [ebp - 0x214]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push edi
push eax
push 0x6a
push dword [0x10080e0]
call esi
lea eax, [ebp - 0x214]
push 0x17
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003483
lea eax, [ebp - 0xc]
push ebx
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10034de
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
push ebx
push esi
lea eax, [ebp - 0x720]
push edi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x518]
push esi
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, dword [0x100898c]
push 0x14
xor edx, edx
pop ecx
div ecx
inc dword [0x100898c]
lea eax, [ebp - 0x310]
push edx
push 0x100185c
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
lea eax, [ebp - 0x518]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x10035be
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x310]
push esi
push eax
push 0x75
push dword [0x10080e0]
call edi
lea eax, [ebp - 0x720]
push esi
push eax
push 0x7e
push dword [0x10080e0]
call edi
lea eax, [ebp - 0x310]
push 0x10010
push eax
lea eax, [ebp - 0x720]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1003656
cmp dword [ebp + 8], ebx
je 0x10035d6
push esi
lea eax, [ebp - 0x928]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x10035dd
mov word [ebp - 0x928], bx
lea eax, [ebp - 0x108]
push esi
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.0100348a
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp + 0x10]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call edi
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x108]
push eax
call esi
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
call edi
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp + 0x14]
call esi
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
lea eax, [ebp - 0x518]
push eax
call fcn.01003847
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10036eb
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x17
push dword [ebp + 8]
push dword [0x10080e0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x100376c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x100376c
push esi
push edi
push dword [0x10080e0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1003762
push edi
push dword [0x10080e0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp + 0xc]
push 0
push ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
ret 8
Function at 0x1003771
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100378a
cmp dword [ebp + 0xc], 0
jg 0x1003797
lea ebx, [ebp - 0x220]
mov dword [ebp + 0xc], 0x104
push 6
mov esi, 0x1001974
pop ecx
lea edi, [ebp - 0x18]
push ebx
push dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x10], 0
jne 0x10037cb
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10037d5
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.010036eb
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1003942
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
lea eax, [ebp - 0x54]
push edi
xor esi, esi
push eax
push 0x1001d60
mov dword [ebp - 4], esi
call fcn.01002523
cmp dword [ebp + 8], esi
mov edi, 0x104
je 0x1003970
cmp dword [ebp + 0xc], esi
jg 0x100397c
lea eax, [ebp - 0x66c]
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x54]
mov esi, 0x1008518
push dword [ebp + 8]
push eax
push esi
call fcn.01002ad2
cmp dword [ebp + 0x10], 0
mov ebx, eax
je 0x10039da
cmp dword [ebp + 0x14], 0
jle 0x10039da
push esi
lea eax, [ebp - 0x464]
push edi
push eax
push 0x1001520
lea eax, [ebp - 0x54]
push 0x1001750
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x464]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.010038d9
test ebx, ebx
jl 0x1003ab6
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x1003ab6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
push eax
lea eax, [ebp - 0x464]
push eax
call esi
lea eax, [ebp - 0x464]
push 7
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x464]
push eax
push 0x10019bc
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1003a2a
lea eax, [ebp - 0x456]
mov dword [ebp + 0x14], eax
push dword [ebp + 0x14]
mov ebx, 0x1008308
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
lea eax, [ebp - 0x25c]
push ebx
push eax
call esi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_IsLFNDriveW]
test eax, eax
je 0x1003a5f
push 0x1001538
jmp 0x1003a64
push 0x1001528
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x25c]
push 0x1001738
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1003aaf
push dword [ebp + 0xc]
lea eax, [ebp - 0x25c]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 8]
call esi
jmp 0x1003ab6
mov dword [ebp - 4], 2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1003b8b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push esi
push edi
push 0x10019cc
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x1003c64
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push ebx
push eax
call esi
mov edi, 0x20000
push ebx
lea eax, [ebp - 0x28]
push edi
push eax
call esi
mov esi, 0x2000
test dword [ebp - 0x28], esi
jne 0x1003c64
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x230]
push 0x104
push eax
push 0x75
push dword [0x10080e0]
call ebx
lea eax, [ebp - 0x438]
push 0x104
push eax
push 0x85
push dword [0x10080e0]
call ebx
lea eax, [ebp - 0x230]
push 0x10021
push eax
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
je 0x1003c4a
and dword [ebp - 4], 0
jmp 0x1003c64
or dword [ebp - 0x28], esi
push 1
lea eax, [ebp - 0x28]
push edi
push eax
call dword [ebp - 8]
push 1
push 0x1003b53
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1003ccd
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 0xc], 0x80004005
je 0x1003e2e
cmp word [esi], bx
je 0x1003e2e
lea eax, [ebp - 0x214]
push eax
push 0x1008308
call fcn.010025e2
test eax, eax
jl 0x1003e24
lea eax, [ebp - 0x214]
push 0x1001a60
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1003e24
push ebx
push 0x80
push 2
push ebx
push ebx
lea eax, [ebp - 0x214]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1003e24
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push ebx
push eax
push 2
push 0x10013e8
push dword [ebp - 4]
call edi
cmp eax, ebx
je 0x1003e19
push ebx
lea eax, [ebp - 8]
mov ebx, 0x1001468
push eax
push ebx
call esi
shl eax, 1
push eax
push ebx
push dword [ebp - 4]
call edi
test eax, eax
je 0x1003e19
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 8]
call esi
shl eax, 1
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call edi
test eax, eax
je 0x1003e19
lea eax, [ebp - 8]
push 0
mov ebx, 0x1001510
push eax
push ebx
call esi
shl eax, 1
push eax
push ebx
push dword [ebp - 4]
call edi
test eax, eax
je 0x1003e19
mov esi, 0x1008518
push esi
call dword [sym.imp.SHELL32.dll_IsLFNDriveW]
test eax, eax
push 0x104
je 0x1003de8
push 0x1001a18
jmp 0x1003ded
push 0x10019e4
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x214]
push esi
push eax
push 0x1001638
push 0x1001618
call fcn.01002488
test eax, eax
je 0x1003e19
and dword [ebp - 0xc], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push ebx
push 2
call fcn.010030f2
jmp 0x1003ea3
mov esi, 0x1008518
lea eax, [ebp - 0x214]
push esi
push 0x104
mov ebx, 0x1001638
push eax
mov edi, 0x1001618
push ebx
push edi
call fcn.0100243e
lea eax, [ebp - 0x214]
push 7
mov dword [ebp + 8], eax
lea eax, [ebp - 0x214]
push eax
push 0x10019bc
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1003e7b
lea eax, [ebp - 0x206]
mov dword [ebp + 8], eax
push dword [ebp + 8]
push 0x1008308
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push 0
push ebx
push edi
call fcn.01002488
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1004242
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 1
mov esi, ecx
push 0xf1
push 0x402
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x9d
mov ecx, esi
call fcn.010041e6
mov edi, 0x100800c
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 4]
push eax
push 0x1001310
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x10042b6
xor eax, eax
cmp dword [edi], 0x404
sete al
mov dword [ebp - 4], eax
xor eax, eax
push 0
cmp dword [ebp - 4], eax
setne al
push eax
push 0xf1
push dword [edi]
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 4]
mov ecx, dword [esi + 4]
push dword [edi - 4]
call fcn.01006453
add edi, 0x44
cmp edi, 0x10080d8
jb 0x100427d
call fcn.0100277e
test eax, eax
jne 0x1004321
call fcn.01002822
test eax, eax
jne 0x1004321
call fcn.010028c9
test eax, eax
jne 0x1004321
call fcn.010028fb
test eax, eax
jne 0x1004321
push eax
push 0x3f3
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [esi]
mov ecx, dword [esi + 4]
call fcn.01006623
call fcn.01004237
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100472b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
lea eax, [ebp - 4]
push ebx
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x10016ac
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004846
push edi
mov edi, 0x104
push esi
lea eax, [ebp - 0x620]
push edi
push eax
lea eax, [ebp - 0x828]
push edi
push eax
call fcn.01003942
mov esi, eax
cmp esi, ebx
je 0x10047f8
lea eax, [ebp - 0x8f4]
push 0x64
push eax
push 0x81
push dword [0x10080e0]
mov word [ebp - 0x91c], bx
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
call ebx
dec esi
lea eax, [ebp - 0x418]
neg esi
sbb esi, esi
and word [ebp - 0x82a], 0
push edi
push eax
and esi, 0xd
push 0x82
push dword [0x10080e0]
add esi, 0x41
mov word [ebp - 0x82c], si
call ebx
mov eax, dword [0x1008dcc]
inc dword [0x1008dcc]
mov dword [ebp - 0x920], eax
lea eax, [ebp - 0x920]
push eax
call fcn.010049ab
test eax, eax
je 0x10047f8
mov dword [ebp - 8], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0x210]
xor ebx, ebx
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x100483b
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0100484c
test eax, eax
je 0x100482c
mov dword [ebp - 8], 1
lea eax, [ebp - 0x210]
inc ebx
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x100480c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, dword [ebp - 8]
pop ebx
leave
ret