joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a3fe
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10015ba0]
je 0x1000a419
inc edi
cmp edi, 0x17
jb 0x1000a40a
cmp edi, 0x17
jae 0x1000a599
push ebp
push 3
call fcn.1000f668
cmp eax, 1
pop ecx
je 0x1000a565
push 3
call fcn.1000f668
test eax, eax
pop ecx
jne 0x1000a44d
cmp dword [0x100160d0], 1
je 0x1000a565
cmp ebx, 0xfc
je 0x1000a598
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10016608
push ebp
call fcn.1000ed59
add esp, 0xc
test eax, eax
je 0x1000a483
push esi
push esi
push esi
push esi
push esi
call fcn.1000574a
add esp, 0x14
push 0x104
mov esi, 0x10016621
push esi
push 0
mov byte [0x10016725], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000a4c7
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000ed59
add esp, 0xc
test eax, eax
je 0x1000a4c7
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000574a
add esp, 0x14
push esi
call fcn.1000e340
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1000a50c
push esi
call fcn.1000e340
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001691c
push 0x1001198c
sub ecx, eax
push ecx
push eax
call fcn.1000eca6
add esp, 0x14
test eax, eax
je 0x1000a50c
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000574a
add esp, 0x14
jmp 0x1000a50e
xor esi, esi
push 0x10011988
push ebx
push ebp
call fcn.1000ebec
add esp, 0xc
test eax, eax
je 0x1000a52e
push esi
push esi
push esi
push esi
push esi
call fcn.1000574a
add esp, 0x14
push dword [edi*8 + 0x10015ba4]
push ebx
push ebp
call fcn.1000ebec
add esp, 0xc
test eax, eax
je 0x1000a550
push esi
push esi
push esi
push esi
push esi
call fcn.1000574a
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1000f4ab
add esp, 0xc
jmp 0x1000a598
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1000a598
cmp ebp, 0xffffffff
je 0x1000a598
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10015ba4]
push dword [esi]
call fcn.1000e340
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1000f4ab
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100086f2
xor ebx, ebx
cmp dword [0x10016aac], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1000f581
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1000f661
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1000f661
push eax
call fcn.10008684
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10016aac], eax
call esi
push eax
call fcn.10008684
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10016ab0], eax
call esi
push eax
call fcn.10008684
mov dword [0x10016ab4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000a1ab
test eax, eax
pop ecx
pop ecx
je 0x1000f54f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000574a
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1000f581
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10008684
cmp eax, ebx
pop ecx
mov dword [0x10016abc], eax
je 0x1000f581
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10008684
pop ecx
mov dword [0x10016ab8], eax
mov eax, dword [0x10016ab8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1000f606
cmp dword [0x10016abc], ecx
je 0x1000f606
push eax
call fcn.100086fb
push dword [0x10016abc]
mov esi, eax
call fcn.100086fb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1000f606
cmp edi, ebx
je 0x1000f606
call esi
cmp eax, ebx
je 0x1000f5d3
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000f5d3
test byte [ebp - 0x18], 1
jne 0x1000f606
lea eax, [ebp - 0x10]
push eax
call fcn.1000a1e2
test eax, eax
pop ecx
je 0x1000f5ee
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000574a
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1000f5fd
or dword [ebp + 0x10], 0x200000
jmp 0x1000f641
or dword [ebp + 0x10], 0x40000
jmp 0x1000f641
mov eax, dword [0x10016ab0]
cmp eax, dword [ebp - 8]
je 0x1000f641
push eax
call fcn.100086fb
cmp eax, ebx
pop ecx
je 0x1000f641
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000f641
mov eax, dword [0x10016ab4]
cmp eax, dword [ebp - 8]
je 0x1000f641
push eax
call fcn.100086fb
cmp eax, ebx
pop ecx
je 0x1000f641
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10016aac]
call fcn.100086fb
cmp eax, ebx
pop ecx
je 0x1000f661
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000f663
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x472008]
jne 0x40100a
repz ret
jmp fcn.00401910

Function at 0x404efa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032f7
and dword [ebp - 4], 0
cmp dword [0x4739f0], 0
mov ebx, eax
jne 0x404fab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40505c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40505c
push eax
call fcn.00403285
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4739f0], eax
call esi
push eax
call fcn.00403285
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4739f4], eax
call esi
push eax
call fcn.00403285
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4739f8], eax
call esi
push eax
call fcn.00403285
pop ecx
mov dword [0x473a00], eax
test eax, eax
je 0x404fab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403285
pop ecx
mov dword [0x4739fc], eax
mov eax, dword [0x4739fc]
cmp eax, ebx
je 0x405003
cmp dword [0x473a00], ebx
je 0x405003
push eax
call fcn.00403300
push dword [0x473a00]
mov esi, eax
call fcn.00403300
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405003
test edi, edi
je 0x405003
call esi
test eax, eax
je 0x404ffa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404ffa
test byte [ebp - 0xc], 1
jne 0x405003
or dword [ebp + 0x10], 0x200000
jmp 0x40503c
mov eax, dword [0x4739f4]
cmp eax, ebx
je 0x40503c
push eax
call fcn.00403300
pop ecx
test eax, eax
je 0x40503c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40503c
mov eax, dword [0x4739f8]
cmp eax, ebx
je 0x40503c
push eax
call fcn.00403300
pop ecx
test eax, eax
je 0x40503c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4739f0]
call fcn.00403300
pop ecx
test eax, eax
je 0x40505c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40505e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46ed60
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x472008]
xor eax, esp
mov dword [esp + 0x800], eax
cmp dword [0x85951c], 0x114e
mov eax, dword [esp + 0x808]
mov dword [0x859360], eax
jne 0x46eda1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret
Function at 0x46ee80
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc04
mov eax, dword [0x472008]
xor eax, esp
mov dword [esp + 0xc00], eax
mov eax, dword [0x472c50]
push ebx
mov ebx, dword [0x859364]
push esi
mov esi, dword [0x85951c]
push eax
call fcn.0046ed60
add esp, 4
cmp dword [0x85951c], 0x2f
jne 0x46eebf
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
call fcn.0046edd0
add esp, 4
cmp dword [0x85951c], 0x568
pop esi
pop ebx
jne 0x46eef7
push 0
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
lea edx, [esp + 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.00401000
add esp, 0xc04
ret
Function at 0x100011a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.100046d0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
mov ecx, dword [esp + 0x114]
seta al
xor ecx, esp
call fcn.100046b7
add esp, 0x118
ret

Function at 0x10001380
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x42c]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push esi
mov esi, dword [esp + 0x430]
push edi
push 0x100
lea ecx, [esp + 0x28]
push ecx
xor edi, edi
push edi
push esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], edi
xor bl, bl
call ebp
test eax, eax
jne 0x100014ab
mov edi, edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20019
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10001492
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.GDFBinaryPath
push edx
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001483
mov ecx, dword [esp + 0x438]
lea eax, [esp + 0x224]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001466
test dx, dx
je 0x10001462
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001466
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001440
xor eax, eax
jmp 0x1000146b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001483
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
mov bl, 1
call fcn.100012b0
add esp, 8
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x100014ab
push 0x100
lea eax, [esp + 0x28]
push eax
add edi, 1
push edi
push esi
call ebp
test eax, eax
je 0x100013d0
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.100046b7
add esp, 0x420
ret
Function at 0x100014d0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x414
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x424]
push ebp
mov ebp, dword [esp + 0x424]
push esi
push edi
mov edi, dword [esp + 0x428]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0x100117ac
push 1
push 0
push 0x100117bc
setge byte [esp + 0x27]
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x100015c5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push edi
push eax
call edx
test ebp, ebp
je 0x1000154d
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push ebp
push eax
call edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x200
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10001570
mov word [eax], 0
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
lea ecx, [esp + 0x20]
push ecx
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x100117cc
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
jl 0x100015b9
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebx
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp byte [esp + 0x13], 0
je 0x100015d2
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x420]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100046b7
add esp, 0x414
ret
Function at 0x100016c0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes

Disassembly:
mov eax, 0x124c
call fcn.100047f0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1248], eax
mov eax, dword [esp + 0x1258]
push esi
mov esi, dword [esp + 0x1254]
lea ecx, [esp + 0x20c]
push ecx
lea edx, [esp + 0x1048]
push edx
push eax
call fcn.10001640
add esp, 0xc
push esi
push 0x104
lea eax, [esp + 0x624]
push eax
call fcn.100010a0
lea ecx, [esp + 0x61c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [esp + 0x20c]
push edx
lea eax, [esp + 0x620]
push eax
push str._s_s_MCE.png
lea ecx, [esp + 0xa38]
push 0x104
push ecx
call fcn.10001610
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x634]
push eax
push str._s_s_MCE.lnk
lea ecx, [esp + 0xe5c]
push 0x104
push ecx
call fcn.10001610
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x28
lea edx, [esp + 0xa2c]
push edx
call esi
lea eax, [esp + 0xe3c]
push eax
call esi
cmp byte [esp + 0x1260], 0
je 0x1000188b
push 0x104
lea ecx, [esp + 0xc38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0xc34]
push edx
push str._sehomeRegisterMCEApp.exe
lea eax, [esp + 0x41c]
push 0x104
push eax
call fcn.10001610
add esp, 0x10
lea ecx, [esp + 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100017ff
mov eax, 0x80004005
pop esi
mov ecx, dword [esp + 0x1248]
xor ecx, esp
call fcn.100046b7
add esp, 0x124c
ret 0x10
lea edx, [esp + 0x20c]
push edx
lea eax, [esp + 0x620]
push eax
push str._s_s_MCE.xml
lea ecx, [esp + 0x830]
push 0x104
push ecx
call fcn.10001610
add esp, 0x14
cmp dword [esp + 0x1258], 3
jne 0x1000184c
lea edx, [esp + 0x824]
push edx
push str._u__allusers___s_
push 0x104
lea eax, [esp + 0x10]
push eax
jmp 0x10001863
lea ecx, [esp + 0x824]
push ecx
push str._u___s_
push 0x104
lea edx, [esp + 0x10]
push edx
call fcn.10001610
add esp, 0x10
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x420]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000194d
lea edx, [esp + 0x20c]
push edx
lea eax, [esp + 0x620]
push eax
push str._s_s_MCE.mcl
lea ecx, [esp + 0x830]
push 0x104
push ecx
call fcn.10001610
add esp, 0x14
call fcn.100011a0
test al, al
je 0x10001909
cmp dword [esp + 0x1258], 3
jne 0x100018d5
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x23
jmp 0x100018e0
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x20c]
push ecx
lea edx, [esp + 8]
push edx
push str._sMedia_Center_Programs_s.lnk
push 0x104
lea eax, [esp + 0x424]
push eax
jmp 0x1000193b
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [esp + 0x20c]
push edx
lea eax, [esp + 8]
push eax
push str._sProgramsAccessoriesMedia_CenterMedia_Center_Programs_s.lnk
push 0x104
lea ecx, [esp + 0x424]
push ecx
call fcn.10001610
add esp, 0x14
lea edx, [esp + 0x414]
push edx
call esi
mov ecx, dword [esp + 0x124c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.100046b7
add esp, 0x124c
ret 0x10
Function at 0x10001a40
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x90c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x908], eax
push esi
mov esi, dword [esp + 0x914]
push edi
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
lea eax, [esp + 0xc]
push eax
push 0x100105cc
push 1
push 0
push 0x100105bc
setge byte [esp + 0x1f]
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jl 0x10001ac1
mov edi, dword [esi]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], edi
mov edi, dword [esi + 4]
mov dword [eax + 4], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x10]
push ecx
call eax
mov edi, eax
jmp 0x10001b67
test esi, esi
je 0x10001b67
push 0xfe
lea ecx, [esp + 0x16]
push 0
push ecx
mov word [esp + 0x1c], 0
call fcn.100046d0
add esp, 0xc
push 0x80
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov edi, eax
test edi, edi
jl 0x10001b67
lea eax, [esp + 0x10]
push eax
push str.SoftwareClassesSoftwareMicrosoftWindowsCurrentVersionGameUXGamesToFindOnWindowsUpgrade_s
lea ecx, [esp + 0x118]
push 0x400
push ecx
call fcn.10001610
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 0x10
test eax, eax
jl 0x10001b33
lea edx, [esp + 0x110]
push edx
push SysReAllocString
call esi
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionGameUXGamesToFindOnWindowsUpgrade_s
lea ecx, [esp + 0x118]
push 0x400
push ecx
call fcn.10001610
add esp, 0x10
test eax, eax
jl 0x10001b65
lea edx, [esp + 0x110]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
xor edi, edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10001b77
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp byte [esp + 0xb], 0
je 0x10001b84
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x910]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100046b7
add esp, 0x90c
ret 4
Function at 0x10001ec0
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0xc0c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xc08], eax
cmp dword [esp + 0xc10], 2
push ebx
mov ebx, dword [esp + 0xc28]
push ebp
mov ebp, dword [esp + 0xc30]
push esi
mov esi, dword [esp + 0xc20]
push edi
mov edi, dword [esp + 0xc30]
jne 0x10001f0b
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x1c
jmp 0x10001f16
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x100
lea edx, [esp + 0x21c]
push edx
push esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jl 0x10001fc4
cmp dword [esp + 0xc28], 0
mov eax, str.SupportTasks
jne 0x10001f4e
mov eax, str.PlayTasks
mov ecx, dword [esp + 0xc2c]
push ecx
push eax
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x1c]
push eax
push str._sMicrosoftWindowsGameExplorer_s_s_d
lea ecx, [esp + 0x42c]
push 0x200
push ecx
call fcn.10001610
add esp, 0x1c
push 0
lea edx, [esp + 0x41c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
lea eax, [esp + 0x41c]
push eax
push 0x10010824
lea ecx, [esp + 0x824]
push 0x200
push ecx
call fcn.10001610
lea edx, [esp + 0x82c]
push edx
push ebp
push ebx
call fcn.100014d0
add esp, 0x20
xor eax, eax
mov ecx, dword [esp + 0xc18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100046b7
add esp, 0xc0c
ret 0x1c
Function at 0x10001fe0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0xa34
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa30], eax
push esi
push edi
mov edi, dword [esp + 0xa40]
push 0x3fe
lea eax, [esp + 0x22e]
push 0
push eax
mov word [esp + 0x234], 0
call fcn.100046d0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0xc
lea ecx, [esp + 0x628]
push ecx
push 0
push 0
push 0x1c
push 0
call esi
test eax, eax
jl 0x1000215c
lea edx, [esp + 0x830]
push edx
push 0
push 0
push 0x23
push 0
call esi
test eax, eax
jl 0x1000215c
push 0x100
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jl 0x1000215c
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x62c]
push edx
push str._sMicrosoftWindowsGameExplorer_s
lea eax, [esp + 0x234]
push 0x200
push eax
call fcn.10001610
add esp, 0x14
test eax, eax
jl 0x1000215c
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
xor eax, eax
lea edx, [esp + 8]
lea ecx, [esp + 0x228]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov edi, 0x414
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], ecx
mov word [esp + 0x1c], di
call esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x834]
push ecx
push str._sMicrosoftWindowsGameExplorer_s
lea edx, [esp + 0x234]
push 0x200
push edx
call fcn.10001610
add esp, 0x14
test eax, eax
jl 0x1000215c
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
lea ecx, [esp + 8]
lea eax, [esp + 0x228]
push ecx
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], eax
mov word [esp + 0x1c], di
call esi
xor eax, eax
mov ecx, dword [esp + 0xa38]
pop edi
pop esi
xor ecx, esp
call fcn.100046b7
add esp, 0xa34
ret 4
Function at 0x10002600
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x804
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
test esi, esi
jne 0x1000263d
mov eax, 0x80070057
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.100046b7
add esp, 0x804
ret 4
cmp word [esi], 0x2e
push esi
jne 0x10002673
push 0x100
lea eax, [esp + 0xc]
push eax
call fcn.100010a0
add esi, 2
push esi
push str._sType
lea ecx, [esp + 0x20c]
push 0x100
push ecx
call fcn.10001610
add esp, 0x10
jmp 0x100026a2
push 0x10010c84
lea edx, [esp + 0xc]
push 0x100
push edx
call fcn.10001610
push esi
push str._sType
lea eax, [esp + 0x21c]
push 0x100
push eax
call fcn.10001610
add esp, 0x20
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [esp + 4]
push ecx
push SysReAllocString
call esi
lea edx, [esp + 0x204]
push edx
push SysReAllocString
call esi
lea eax, [esp + 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPropertySystemPropertyHandlers_s
lea ecx, [esp + 0x40c]
push 0x200
push ecx
call fcn.10001610
add esp, 0x10
lea edx, [esp + 0x404]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
xor eax, eax
call fcn.100046b7
add esp, 0x804
ret 4