joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000de70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push dword [esp + 0x24]
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x20]
push esi
push eax
call fcn.10003580
push dword [esp + 0x34]
lea eax, [esp + 0x34]
push esi
push eax
call fcn.10003580
mov esi, dword [esp + 0x34]
add esp, 0x18
xor bl, bl
test esi, esi
je 0x1000deae
xor eax, eax
cmp dword [esi], eax
sete al
jmp 0x1000deb3
mov eax, 1
push edi
mov edi, dword [esp + 0x28]
test al, al
jne 0x1000df6d
test edi, edi
je 0x1000decd
xor eax, eax
cmp dword [edi], eax
sete al
jmp 0x1000ded2
mov eax, 1
test al, al
jne 0x1000df6d
test esi, esi
je 0x1000dee2
mov eax, dword [esi]
jmp 0x1000dee4
xor eax, eax
lea ecx, [esp + 0x2c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1000df1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1000df05
mov eax, dword [eax]
jmp 0x1000df07
xor eax, eax
lea ecx, [esp + 0x2c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000df65
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], 4
test eax, eax
je 0x1000df30
mov eax, dword [eax]
jmp 0x1000df32
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x2c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000df65
cmp dword [esp + 0x14], esi
setne bl
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov ecx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
or ebp, 0xffffffff
test edi, edi
je 0x1000dfcb
mov eax, ebp
lock xadd dword [edi + 8], eax
dec eax
jne 0x1000dfbf
test edi, edi
je 0x1000dfbf
mov eax, dword [edi]
test eax, eax
je 0x1000df97
push eax
call ecx
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1000dfae
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.1003c33a
mov ecx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 8
mov esi, dword [esp + 0x20]
mov dword [esp + 0x28], 0
pop edi
test esi, esi
je 0x1000e00d
lock xadd dword [esi + 8], ebp
dec ebp
jne 0x1000e00d
test esi, esi
je 0x1000e00d
mov eax, dword [esi]
test eax, eax
je 0x1000dfeb
push eax
call ecx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000e002
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 0x10
Function at 0x1000e020
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x18], eax
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x1000e05d
push 0
push str.TrayNotifyWnd
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp]
cmp eax, dword [esp + 8]
jl 0x1000e09b
cmp eax, dword [esp + 0x10]
jg 0x1000e09b
mov eax, dword [esp + 4]
cmp eax, dword [esp + 0xc]
jl 0x1000e09b
cmp eax, dword [esp + 0x14]
jg 0x1000e09b
xor al, al
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x18]
mov al, 1
xor ecx, esp
call fcn.1003b4ee
add esp, 0x1c
ret 8

Function at 0x1000e350
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1840
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x183c], eax
push esi
push 0x1003fa44
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push 0x800
lea ecx, [esp + 0x44]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x40]
mov dl, 1
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e390
sub ecx, esi
sar ecx, 1
add ecx, 0xffffffff
pop esi
js 0x1000e3d3
test dl, dl
jne 0x1000e3b6
mov ax, word [esp + ecx*2 + 0x3c]
mov word [esp + ecx*2 + 0x83c], ax
cmp word [esp + ecx*2 + 0x3c], 0x5c
jne 0x1000e3ce
test dl, dl
je 0x1000e3ce
xor eax, eax
xor dl, dl
mov word [esp + ecx*2 + 0x83c], ax
sub ecx, 1
jns 0x1000e3a5
lea eax, [esp + 0x83c]
push eax
lea eax, [esp + 0x1040]
push str._sjavacpl.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [esp], 0x3c
lea eax, [esp + 0x103c]
mov dword [esp + 4], 0
xorps xmm0, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp]
movlpd qword [esp + 0x24], xmm0
push eax
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0x1003e6b4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 5
mov dword [esp + 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1000e475
push 0x10
push str.Unable_to_Start_Java_Plug_in_Control_Panel
lea eax, [esp + 0x1044]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x183c]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x1840
ret 8
Function at 0x1000e5b0
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push edi
push dword [esp + 0x18]
push esi
push eax
call fcn.10003580
push dword [esp + 0x28]
lea eax, [esp + 0x28]
push esi
push eax
call fcn.10003580
mov esi, dword [esp + 0x28]
add esp, 0x18
test esi, esi
je 0x1000e5e9
xor eax, eax
cmp dword [esi], eax
sete al
jmp 0x1000e5ee
mov eax, 1
mov edi, dword [esp + 0x18]
test al, al
jne 0x1000e695
test edi, edi
je 0x1000e607
xor eax, eax
cmp dword [edi], eax
sete al
jmp 0x1000e60c
mov eax, 1
test al, al
jne 0x1000e695
test esi, esi
je 0x1000e61c
mov eax, dword [esi]
jmp 0x1000e61e
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1000e656
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000e63f
mov eax, dword [eax]
jmp 0x1000e641
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000e68d
movzx eax, byte [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000e66b
mov eax, dword [eax]
jmp 0x1000e66d
xor eax, eax
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
or ebx, 0xffffffff
test edi, edi
je 0x1000e6eb
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x1000e6df
test edi, edi
je 0x1000e6df
mov eax, dword [edi]
test eax, eax
je 0x1000e6bd
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1000e6d4
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.1003c33a
add esp, 8
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], 0
test esi, esi
je 0x1000e730
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x1000e730
test esi, esi
je 0x1000e730
mov eax, dword [esi]
test eax, eax
je 0x1000e70e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000e725
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
pop edi
pop esi
pop ebx
ret 0x14
Function at 0x1000e7f0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2010
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x200c], eax
mov eax, dword [esp + 0x201c]
push ebx
xor ebx, ebx
mov dword [esp + 8], ebx
push edi
mov edi, dword [esp + 0x201c]
test eax, eax
je 0x1000e85b
push eax
lea eax, [esp + 0x10]
push edi
push eax
call fcn.10003580
add esp, 0xc
mov eax, dword [eax]
test eax, eax
je 0x1000e83b
mov eax, dword [eax]
jmp 0x1000e83d
xor eax, eax
push 0x1000
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov byte [esp + 0xb], bl
test eax, eax
jne 0x1000e860
mov byte [esp + 0xb], 0
test bl, 1
je 0x1000e8b3
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1000e8b2
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x1000e8b2
test esi, esi
je 0x1000e8b2
mov eax, dword [esi]
test eax, eax
je 0x1000e890
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000e8a7
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
pop esi
cmp byte [esp + 0xb], 0
je 0x1000e8ca
lea eax, [esp + 0x14]
push eax
push edi
call fcn.100036a0
add esp, 8
jmp 0x1000e8cc
xor eax, eax
mov ecx, dword [esp + 0x2014]
pop edi
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2010
ret 0xc

Function at 0x1000ead0
Capabilities:
Delete registry key

Disassembly:
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push dword [esp + 8]
push eax
call fcn.10003580
add esp, 0xc
mov eax, dword [eax]
test eax, eax
je 0x1000eaef
mov eax, dword [eax]
jmp 0x1000eaf1
xor eax, eax
push esi
push edi
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, dword [esp + 0x18]
mov edi, eax
test esi, esi
je 0x1000eb4c
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x1000eb4c
test esi, esi
je 0x1000eb4c
mov eax, dword [esi]
test eax, eax
je 0x1000eb2a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000eb41
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
mov eax, edi
pop edi
pop esi
ret 0x10
Function at 0x1000eb60
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1000eb6e
or eax, 0xffffffff
ret 0x10
push eax
push dword [esp + 8]
lea eax, [esp + 0x18]
push eax
call fcn.10003580
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x1000eb8c
mov eax, dword [eax]
jmp 0x1000eb8e
xor eax, eax
push esi
push edi
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [esp + 0x18]
mov edi, eax
test esi, esi
je 0x1000ebe9
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x1000ebe9
test esi, esi
je 0x1000ebe9
mov eax, dword [esi]
test eax, eax
je 0x1000ebc7
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000ebde
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x1000ebf0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x2008
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x2004], eax
mov eax, dword [esp + 0x2014]
lea ecx, [esp]
push esi
mov esi, dword [esp + 0x2010]
push 0
push 0
push 0
push 0
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0x1000
push ecx
push dword [esp + 0x2034]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1000ec68
lea eax, [esp + 8]
push eax
push esi
call fcn.100036a0
add esp, 8
pop esi
mov ecx, dword [esp + 0x2004]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2008
ret 0x14
mov ecx, dword [esp + 0x2008]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2008
ret 0x14

Function at 0x1000ec90
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2008
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x2004], eax
mov eax, dword [esp + 0x201c]
mov ecx, dword [esp + 0x2014]
push esi
mov esi, dword [esp + 0x2010]
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x2034]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1000ed0c
lea eax, [esp + 8]
push eax
push esi
call fcn.100036a0
add esp, 8
pop esi
mov ecx, dword [esp + 0x2004]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2008
ret 0x14
mov ecx, dword [esp + 0x2008]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2008
ret 0x14
Function at 0x1000eee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2014
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x2010], eax
mov eax, dword [esp + 0x2024]
push ebx
push esi
mov esi, dword [esp + 0x2028]
push edi
mov edi, dword [esp + 0x2024]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x1000
push edi
push eax
call fcn.10003580
add esp, 0xc
mov eax, dword [eax]
test eax, eax
je 0x1000ef31
mov eax, dword [eax]
jmp 0x1000ef33
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [esp + 0x10]
test eax, eax
sete bl
test esi, esi
je 0x1000ef9d
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x1000ef9d
test esi, esi
je 0x1000ef9d
mov eax, dword [esi]
test eax, eax
je 0x1000ef7b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000ef92
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
test bl, bl
je 0x1000efc6
cmp dword [esp + 0xc], 0
jbe 0x1000efc6
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x1000efb6
cmp eax, 2
jne 0x1000efc6
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.100036a0
add esp, 8
jmp 0x1000efc8
xor eax, eax
mov ecx, dword [esp + 0x201c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2014
ret 0x10
Function at 0x1000eff0
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 0x10], 0
je 0x1000f183
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000f183
push ebp
push esi
push edi
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
call fcn.10003580
mov esi, dword [esp + 0x2c]
add esp, 0xc
xor ecx, ecx
or eax, 0xffffffff
test esi, esi
je 0x1000f133
mov ebp, dword [esi]
mov edi, ebp
test edi, edi
je 0x1000f133
movzx eax, word [edi]
test ax, ax
je 0x1000f06d
mov edx, eax
cmp dx, 0x25
jne 0x1000f051
inc ecx
cmp ecx, 2
je 0x1000f06d
jmp 0x1000f05f
cmp dx, 0x20
je 0x1000f05d
cmp dx, 9
jne 0x1000f05f
xor ecx, ecx
movzx eax, word [edi + 2]
add edi, 2
mov edx, eax
test ax, ax
jne 0x1000f043
push ebx
xor ebx, ebx
cmp ecx, 2
sete bl
inc ebx
test ebp, ebp
je 0x1000f088
push ebp
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, dword [esp + 0x24]
jmp 0x1000f08a
xor eax, eax
lea edi, [eax + eax]
test esi, esi
je 0x1000f095
mov esi, dword [esi]
jmp 0x1000f097
xor esi, esi
push dword [esp + 0x20]
lea eax, [esp + 0x24]
push dword [esp + 0x18]
push eax
call fcn.10003580
add esp, 0xc
mov eax, dword [eax]
test eax, eax
je 0x1000f0b6
mov eax, dword [eax]
jmp 0x1000f0b8
xor eax, eax
push edi
push esi
push ebx
push 0
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [esp + 0x20]
mov edi, eax
pop ebx
test esi, esi
je 0x1000f12a
or eax, 0xffffffff
mov ecx, eax
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x1000f11c
test esi, esi
je 0x1000f11c
mov eax, dword [esi]
test eax, eax
je 0x1000f0f7
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000f10e
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
or eax, 0xffffffff
mov esi, dword [esp + 0x20]
mov dword [esp + 0x1c], 0
jmp 0x1000f136
mov esi, dword [esp + 0x20]
or eax, 0xffffffff
jmp 0x1000f136
or edi, 0xffffffff
test esi, esi
je 0x1000f17b
lock xadd dword [esi + 8], eax
dec eax
jne 0x1000f17b
test esi, esi
je 0x1000f17b
mov eax, dword [esi]
test eax, eax
je 0x1000f159
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000f170
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14
or eax, 0xffffffff
ret 0x14
Function at 0x1000f2b0
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
mov eax, 0x225c
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x2258], eax
push esi
mov esi, dword [esp + 0x2264]
lea eax, [esp + 0x25c]
push edi
push 0x1000
push 0
push eax
mov dword [esp + 0x14], 0
call sub.VCRUNTIME140.dll_memset
push 0x1000
lea eax, [esp + 0x1270]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.SOFTWAREMozillaMozilla_Firefox
lea eax, [esp + 0x27c]
mov dword [esp + 0x28], 0x800
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x24
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x264]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1000f36e
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1264]
push eax
push 0
push 0
push str.CurrentVersion
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
test eax, eax
je 0x1000f387
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2258]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x225c
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
lea eax, [esp + 0x1260]
push eax
lea eax, [esp + 0x264]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x264]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1000f36e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x800
push eax
push esi
push 0
push 0
push str.Install_Directory
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
test eax, eax
je 0x1000f3f9
call edi
jmp 0x1000f36e
call edi
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f400
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
je 0x1000f433
lea edi, [esi - 2]
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1000f420
mov eax, dword [0x1003e9cc]
mov dword [edi], eax
lea ecx, [esi - 2]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x1000f436
mov eax, dword [str.extensions]
mov dword [ecx], eax
mov eax, dword [0x10040b40]
mov dword [ecx + 4], eax
mov eax, dword [0x10040b44]
mov dword [ecx + 8], eax
mov eax, dword [0x10040b48]
mov dword [ecx + 0xc], eax
mov eax, dword [0x10040b4c]
mov dword [ecx + 0x10], eax
mov ax, word [0x10040b50]
mov word [ecx + 0x14], ax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x1000f496
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000f4a8
jmp 0x1000f36e
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [esp + 0x10], 0x10
je 0x1000f36e
mov ecx, dword [esp + 0x2260]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x225c
ret
Function at 0x1000f5c0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov eax, 0x2254
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x2250], eax
push esi
push edi
mov edi, dword [esp + 0x2260]
lea eax, [esp + 8]
push 0x250
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push edi
lea eax, [esp + 0x1268]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x125c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f76b
push ebx
mov ebx, dword [sym.imp.kernel32.dll_DeleteFileW]
push ebp
mov ebp, dword [sym.imp.kernel32.dll_FindNextFileW]
nop word [eax + eax]
mov ecx, 0x10040b94
lea eax, [esp + 0x3c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000f676
test dx, dx
je 0x1000f672
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000f676
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000f650
xor eax, eax
jmp 0x1000f67b
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000f721
mov ecx, 0x10040b98
lea eax, [esp + 0x3c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000f6b6
test dx, dx
je 0x1000f6b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000f6b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000f690
xor eax, eax
jmp 0x1000f6bb
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000f721
lea eax, [esp + 0x3c]
push eax
push edi
lea eax, [esp + 0x268]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esp + 0x20]
add esp, 0x10
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test byte [esp + 0x10], 0x10
lea eax, [esp + 0x260]
push eax
jne 0x1000f719
call ebx
test eax, eax
jne 0x1000f721
push eax
lea eax, [esp + 0x264]
push eax
call fcn.10012e10
add esp, 8
jmp 0x1000f721
call fcn.1000f5c0
add esp, 4
lea eax, [esp + 0x10]
push eax
push esi
call ebp
test eax, eax
jne 0x1000f640
push esi
call dword [sym.imp.kernel32.dll_FindClose]
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
mov esi, eax
pop ebp
pop ebx
test esi, esi
jne 0x1000f752
push 0
push edi
call fcn.10012e10
add esp, 8
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x2250]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2254
ret
mov ecx, dword [esp + 0x2258]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x2254
ret
Function at 0x100106d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x638
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x634], eax
push ebx
mov ebx, dword [esp + 0x644]
push ebp
mov ebp, dword [esp + 0x650]
push edi
mov edi, dword [esp + 0x648]
push ebp
push edi
mov dword [esp + 0x24], ebx
mov eax, dword [edi]
mov eax, dword [eax + 0x7c]
call eax
mov ecx, dword [edi]
push str._Ljava_lang_Object__V
push str.addElement
push eax
mov eax, dword [ecx + 0x84]
push edi
call eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001088f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
xor esi, esi
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x104
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10010888
mov eax, dword [esp + 0x654]
lea ecx, [esp + 0x2c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100107ae
test dx, dx
je 0x100107aa
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100107ae
add ecx, 4
add eax, 4
test dx, dx
jne 0x10010788
xor eax, eax
jmp 0x100107b3
sbb eax, eax
or eax, 1
test eax, eax
js 0x10010882
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x444]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x208
lea eax, [esp + 0x248]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
mov dword [esp + 0x24], 0x104
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
lea eax, [esp + 0x448]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10010882
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x238]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push str.JavaHome
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
test eax, eax
je 0x1001084c
call ebx
inc esi
jmp 0x10010750
call ebx
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.100036a0
push eax
push dword [esp + 0x20]
push ebp
push edi
call fcn.1000cfd0
lea eax, [esp + 0x24c]
push eax
push edi
call fcn.100036a0
push eax
push dword [esp + 0x38]
push ebp
push edi
call fcn.1000cfd0
add esp, 0x30
inc esi
jmp 0x10010750
push dword [esp + 0x18]
call ebx
pop esi
mov ecx, dword [esp + 0x640]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x638
ret