joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f680
Capabilities:
Set file attributes

Disassembly:
mov eax, esi
call fcn.100611f0
cmp eax, 0xffffffff
je 0x1005f6a3
test al, 7
je 0x1005f6a0
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x1005f6a3
xor eax, eax
ret
mov eax, 1
ret

Function at 0x1005f830
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005f855
mov byte [esi], 0
push 0x94
lea eax, [esp + 0xc]
push 0
push eax
call fcn.1012e060
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1005f8c3
mov dword [esp + 0xc], 4
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test esi, esi
je 0x1005f8a9
push 0x5c
push esi
call fcn.1012baa1
add esp, 8
test eax, eax
je 0x1005f8a9
mov byte [eax], 0
mov ecx, esi
call fcn.1005f760
mov ecx, dword [esp + 0xa4]
pop esi
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 5
jb 0x1005f888
push str.GetSystemWindowsDirectoryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005f888
mov edx, dword [ebp + 0xc]
push edx
push esi
call eax
call fcn.10065240
jmp 0x1005f8a9

Function at 0x1005f900
Capabilities:
Get common file path

Disassembly:
push 0x104
push 0x101c9a28
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5c
push 0x101c9a28
call fcn.1012baa1
add esp, 8
test eax, eax
je 0x1005f936
push str.SYSTEM
push 0x101c9a28
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
ret
Function at 0x1005fd80
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x104], eax
cmp dword [0x101c8674], 0
jne 0x1005fdc1
mov dword [0x101c8674], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1005fdc1
cmp al, 6
jb 0x1005fdc1
mov dword [0x101c8678], 1
jmp 0x1005fdce
cmp dword [0x101c8678], 0
je 0x1005fe89
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.1012e060
add esp, 0xc
cmp byte [0x101c82d0], 0
jne 0x1005fe00
push 0x101c82d0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
mov cl, byte [eax + 0x101c82d0]
mov byte [esp + eax], cl
inc eax
test cl, cl
jne 0x1005fe02
cmp byte [esp], cl
je 0x1005fe3a
lea eax, [esp]
inc eax
cmp byte [eax], 0
jne 0x1005fe18
lea ecx, [esp]
sub eax, ecx
je 0x1005fe3a
cmp byte [esp + eax - 1], 0x5c
je 0x1005fe3a
push 0x10158184
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1005fe40
mov ecx, dword [str.LogWrite.LOG]
mov edx, dword [0x10169cc4]
mov dword [eax], ecx
mov ecx, dword [0x10169cc8]
mov dword [eax + 4], edx
mov dl, byte [0x10169ccc]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp]
push 0x10158250
push eax
call fcn.1012982a
add esp, 8
test eax, eax
je 0x1005fe89
push eax
call fcn.10129ad3
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10127db1
add esp, 0x108
ret

Function at 0x1005fea0
Capabilities:
Check os version
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x218]
push 0x207
lea ecx, [esp + 0xd]
push 0
push ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], 0
call fcn.1012e060
add esp, 0xc
call fcn.1005fd80
mov edx, dword [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0x101c8674], 0
jne 0x1005ff22
mov dword [0x101c8674], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1005ff22
cmp al, 6
jb 0x1005ff22
mov dword [0x101c8678], 1
jmp 0x1005ff2b
cmp dword [0x101c8678], 0
je 0x1005ff7e
push 0x10169bf0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005ff6f
mov edx, dword [esp + 0x21c]
lea ecx, [esp + 8]
push ecx
push edx
push ebp
push ebx
push edi
push esi
call eax
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10127db1
add esp, 0x210
ret
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 8]
push eax
push ecx
jmp 0x1005ff8b
mov eax, dword [esp + 0x21c]
lea edx, [esp + 8]
push edx
push eax
push ebp
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x210]
pop ebp
xor ecx, esp
call fcn.10127db1
add esp, 0x210
ret
Function at 0x100611f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x34
push edi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10061299
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 3
jne 0x1006128d
mov cl, byte [edi]
cmp cl, 0x5c
jne 0x10061221
cmp byte [edi + 1], cl
je 0x10061236
mov eax, edi
test cl, cl
je 0x1006122d
inc eax
cmp byte [eax], 0
jne 0x10061227
sub eax, edi
cmp eax, 0x104
jbe 0x1006128d
push 0xa000000
push 3
push 3
push 0
call fcn.1005aa40
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
je 0x1006128d
push 0x30
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.1012e060
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1006128d
mov eax, dword [esp + 0xc]
pop esi
pop ebx
pop edi
add esp, 0x34
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
or eax, 0xffffffff
pop ebx
pop edi
add esp, 0x34
ret
Function at 0x10061c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10180ee8
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x10061d90
movzx eax, word [esi]
test ax, ax
je 0x10061d90
xor ecx, ecx
movzx eax, ax
mov dword [ebp - 0x20], ecx
cmp ax, 0x20
je 0x10061d86
cmp ax, 9
je 0x10061d86
mov edx, 0xa0
cmp ax, dx
je 0x10061d86
test ecx, ecx
je 0x10061d21
lea ecx, [esi + ecx*2]
mov edx, esi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10061d10
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10061d26
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [ebp - 0x1c], ecx
lea ebx, [ebx]
test ecx, ecx
jl 0x10061d72
sub ecx, 1
mov dword [ebp - 0x1c], ecx
js 0x10061d72
movzx eax, word [esi + ecx*2]
cmp ax, 9
je 0x10061d40
cmp ax, 0x20
je 0x10061d40
mov edx, 0xa0
cmp ax, dx
je 0x10061d40
cmp ax, 0xa
je 0x10061d40
cmp ax, 0xd
je 0x10061d40
cmp word [esi + ecx*2 + 2], 0
je 0x10061d81
xor eax, eax
mov word [esi + ecx*2 + 2], ax
lea eax, [ecx + 1]
jmp 0x10061dcf
inc ecx
movzx eax, word [esi + ecx*2]
jmp 0x10061ce6
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100625d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ebx, 1
test edi, edi
je 0x10062718
test ebp, ebp
je 0x10062718
cmp byte [edi], 0
je 0x10062718
push 0x10169e28
push edi
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x10062632
push 0x10158250
push edi
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
je 0x10062718
push 2
push 0
push esi
call fcn.1012b1f9
add esp, 0xc
push esi
call fcn.1012b0ca
add esp, 4
test eax, eax
je 0x100626eb
push 2
push 0xffffffffffffffff
push esi
xor edi, edi
call fcn.1012b1f9
add esp, 0xc
push esi
push 1
lea eax, [esp + 0x1f]
push 1
push eax
call fcn.1012a83e
add esp, 0x10
test eax, eax
jne 0x100626ad
push 2
push 0xfffffffffffffffe
push esi
call fcn.1012b1f9
add esp, 0xc
test eax, eax
jne 0x100626a7
push esi
push 1
lea ecx, [esp + 0x1f]
push 1
push ecx
call fcn.1012a83e
add esp, 0x10
cmp byte [esp + 0x17], 0xa
je 0x100626a7
cmp dword [esp + 0x24], edi
je 0x100626a7
mov edi, ebx
push 2
push 0xffffffffffffffff
jmp 0x100626c0
cmp byte [esp + 0x17], 0xa
je 0x100626bc
cmp dword [esp + 0x24], edi
je 0x100626bc
mov edi, ebx
push 2
push 0
push esi
call fcn.1012b1f9
add esp, 0xc
test edi, edi
je 0x100626eb
push 0x1015804c
push esi
call fcn.1012a85b
add esp, 8
mov eax, 0x1015804c
mov ecx, ebp
call fcn.1005a090
test eax, eax
je 0x100626fa
push ebp
push 0x1014d8cc
push esi
call fcn.1012a85b
add esp, 0xc
push esi
call fcn.10129ad3
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.10127db1
add esp, 0xc
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0xc
ret

Function at 0x10062a20
Capabilities:
Delete directory
Set file attributes

Disassembly:
xor eax, eax
test esi, esi
je 0x10062a3d
cmp byte [esi], al
je 0x10062a3d
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
ret

Function at 0x10062a40
Capabilities:
Delete directory
Set file attributes

Disassembly:
xor eax, eax
test esi, esi
je 0x10062a7c
cmp byte [esi], al
je 0x10062a7c
push edi
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, eax
test edi, edi
je 0x10062a7b
test ebx, ebx
je 0x10062a7b
push esi
push ebx
push str._MRX__FOLDER___u___s
push 0
call fcn.1006ed90
add esp, 0x10
mov eax, edi
pop edi
ret
Function at 0x10063950
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push ebx
push ebp
push 0
push eax
push ecx
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
jne 0x100639c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x10063992
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100639c0
push 0x118
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push edi
push ebx
push ebp
push 0
push eax
push ecx
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret

Function at 0x100639d0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 8]
push esi
push edi
push ebx
push ebp
push 0
push eax
push 0
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov esi, eax
test esi, esi
jne 0x10063a46
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x10063a14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10063a44
push 0x118
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push edi
push ebx
push ebp
push 0
push eax
push 0
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10064310
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x64
push 0x3c
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.1012e060
mov eax, dword [0x101c85e4]
add esp, 0xc
test eax, eax
jbe 0x1006433d
test esi, esi
je 0x100643ca
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x10064381
test esi, esi
je 0x10064369
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
shrd edx, eax, 0xa
shr eax, 0xa
mov dword [esi], edx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
shrd eax, ecx, 0xa
shr ecx, 0xa
mov dword [0x101c85e4], eax
add esp, 0x64
ret
xor eax, eax
lea edx, [esp]
push edx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
test esi, esi
je 0x100643be
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [esi], eax
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [0x101c85e4], eax
add esp, 0x64
ret

Function at 0x100643d0
Capabilities:
Create directory

Disassembly:
sub esp, 0x410
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push edi
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x19]
push ebx
push eax
mov edi, ecx
mov byte [esp + 0x20], bl
call fcn.1012e060
xor eax, eax
add esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
cmp esi, ebx
je 0x100644b6
cmp edi, ebx
je 0x100644b6
cmp byte [esi], bl
jne 0x1006442b
cmp byte [edi], bl
je 0x100644b6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 1
mov byte [esp + 0x1c], bl
call edi
cmp byte [esi], bl
je 0x10064466
lea ecx, [esp + 0x14]
call fcn.10065200
push esi
lea edx, [esp + 0x18]
push edx
call edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
jne 0x10064492
pop edi
pop ebx
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10127db1
add esp, 0x410
ret
lea edx, [esp + 0x14]
push edx
call fcn.10076170
add esp, 4
pop edi
pop ebx
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10127db1
add esp, 0x410
ret
mov ecx, dword [esp + 0x414]
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10127db1
add esp, 0x410
ret
Function at 0x100648f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x408
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
push 0x3ff
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call fcn.1012e060
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 9
push 0
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x1006495a
xor eax, eax
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.10127db1
add esp, 0x408
ret
mov eax, dword [esp + 4]
push 0x400
lea edx, [esp + 0xc]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x408]
xor eax, eax
test esi, esi
sete al
pop esi
xor ecx, esp
call fcn.10127db1
add esp, 0x408
ret
Function at 0x100649a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x113c
call fcn.10140530
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x1138], eax
push ebx
mov ebx, dword [esp + 0x114c]
push esi
mov esi, dword [esp + 0x1148]
push edi
mov edi, dword [esp + 0x1150]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
test edi, edi
je 0x10064b57
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10064b57
push ebp
lea eax, [esp + 0x10]
push eax
push 0x10008
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, eax
push ebp
call esi
test ebp, ebp
jne 0x10064b0d
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x138]
push edx
push 0
push eax
mov byte [esp + 0x144], 0
mov dword [esp + 0x38], 0x1024
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebp, eax
cmp ebp, 0x103
je 0x10064a7c
test ebp, ebp
jne 0x10064ae7
mov edx, dword [esp + 0x10]
push ebx
lea ecx, [esp + 0x128]
push ecx
push edx
call fcn.100649a0
add esp, 0xc
mov ebp, eax
push ebp
call esi
test ebp, ebp
je 0x10064a17
jmp 0x10064ae7
test ebx, ebx
je 0x10064a8d
push 0
push edi
push str.Deleting_Registry_Hive__s
call ebx
add esp, 0xc
mov eax, dword [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, eax
push ebp
call esi
test ebp, ebp
je 0x10064ae7
test ebx, ebx
je 0x10064ae7
push 0x103
lea ecx, [esp + 0x25]
push 0
push ecx
call fcn.1012e060
add esp, 0xc
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x103
mov edi, eax
lea esi, [esp + 0x24]
call fcn.100652a0
mov eax, dword [esp + 0x18]
mov edx, esi
push edx
push eax
push str.ERROR____Unable_to_delete_the_key__s__Reason:__s
call ebx
add esp, 0x10
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1138]
xor ecx, esp
call fcn.10127db1
add esp, 0x113c
ret
push ebp
call esi
test ebx, ebx
je 0x10064af2
push 0x103
lea edx, [esp + 0x25]
push 0
push edx
call fcn.1012e060
add esp, 0xc
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x103
mov edi, eax
lea esi, [esp + 0x24]
call fcn.100652a0
mov ecx, dword [esp + 0x18]
mov eax, esi
push eax
push ecx
push str.MyRegOpenKey_fails_on_key__s____Reason__s
call ebx
add esp, 0x10
jmp 0x10064af2
mov ecx, dword [esp + 0x1144]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 0x3f2
call fcn.10127db1
add esp, 0x113c
ret

Function at 0x10064b80
Capabilities:
Check if file exists

Disassembly:
push esi
call fcn.10059ee0
cmp al, 1
je 0x10064ba8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10064bae
push esi
call fcn.10086400
cmp eax, 1
jne 0x10064bae
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
ret
xor eax, eax
ret
Function at 0x10064bc0
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, eax
test edi, edi
je 0x10064c4d
cmp byte [edi], 0
je 0x10064c4d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + edi - 1], 0x5c
je 0x10064c4d
cmp dword [0x1019395c], 0xffffffff
jne 0x10064c0a
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1019395c
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call fcn.1006bdc0
add esp, 0x20
pop ebx
cmp dword [0x1019395c], 0
jne 0x10064c3f
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
cmp esi, 2
jne 0x10064c2f
push edi
call fcn.10086400
cmp eax, 1
jne 0x10064c2f
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
sete al
pop esi
ret
push 0
push edi
push esi
call fcn.100649a0
add esp, 0xc
jmp 0x10064c1b
xor eax, eax
pop esi
ret
Function at 0x10065490
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push edi
xor ebx, ebx
push 0x207
lea eax, [esp + 0x11]
push ebx
push eax
mov byte [esp + 0x18], bl
call fcn.1012e060
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esp, 0xc
push ebx
push ebx
push str.Path
call ebp
mov edi, eax
cmp edi, ebx
je 0x100655f2
push esi
add edi, 0xa
push edi
call fcn.1006a7b0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x100655f1
push edi
push esi
push str.Path
call ebp
test eax, eax
je 0x100655e8
cmp byte [esi], bl
je 0x100655e8
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10065510
sub eax, edx
cmp eax, edi
jae 0x1006552c
push 0x1015acf0
call fcn.10068740
add esp, 4
jmp 0x10065531
mov byte [edi + esi - 1], 0x3b
push 0x3b
push esi
call fcn.1012a587
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x100655e8
push 0x208
lea ecx, [esp + 0x14]
push esi
push ecx
mov byte [ebp], bl
call fcn.10129e6f
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10065561
sub eax, edx
cmp eax, 0x208
jb 0x10065578
mov byte [esp + 0x217], bl
cmp byte [esp + 0x10], bl
je 0x100655a8
lea edx, [esp + 0x10]
push ebx
push edx
call fcn.100612a0
add esp, 8
test eax, eax
je 0x100655a8
push ebx
push 1
push 0x101c85e8
xor ecx, ecx
xor edx, edx
lea eax, [esp + 0x1c]
call fcn.10068870
add esp, 0xc
add ebp, 1
je 0x100655d3
cmp byte [ebp], bl
je 0x100655d3
push edi
push ebp
push esi
call fcn.10129e6f
mov eax, ebp
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100655c2
sub eax, edx
cmp edi, eax
ja 0x100655d3
mov byte [edi + esi - 1], bl
push 0x3b
push esi
call fcn.1012a587
mov ebp, eax
add esp, 8
cmp ebp, ebx
jne 0x10065546
push esi
call fcn.10128243
add esp, 4
pop esi
mov ecx, dword [esp + 0x214]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x20c
ret
Function at 0x10066990
Capabilities:
Get common file path

Disassembly:
sub esp, 0x528
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x524], eax
push ebx
push ebp
mov ebp, dword [esp + 0x534]
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x15]
push ebx
push eax
mov byte [esp + 0x1c], bl
call fcn.1012e060
add esp, 0xc
push 0x207
lea ecx, [esp + 0x225]
push ebx
push ecx
mov byte [esp + 0x22c], bl
call fcn.1012e060
add esp, 0xc
push 0x103
lea edx, [esp + 0x42d]
push ebx
push edx
mov byte [esp + 0x434], bl
call fcn.1012e060
add esp, 0xc
push 0x103
lea eax, [esp + 0x11d]
push ebx
push eax
mov byte [esp + 0x124], bl
call fcn.1012e060
add esp, 0xc
cmp ebp, ebx
je 0x10066b85
cmp byte [ebp], bl
je 0x10066b85
push ebx
push ebx
xor edx, edx
mov ecx, ebp
call fcn.10060eb0
add esp, 8
test eax, eax
jne 0x10066b85
mov eax, ebp
call fcn.1005ad10
test eax, eax
jne 0x10066b85
lea ecx, [esp + 0x118]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x10066a75
mov byte [esp + 0x118], bl
jmp 0x10066a81
lea ecx, [esp + 0x118]
call fcn.10065200
lea edx, [esp + 0x428]
push edx
mov ecx, ebp
call fcn.100620f0
add esp, 4
lea eax, [esp + 0x428]
push 0x2e
push eax
call fcn.10129030
mov ecx, eax
add esp, 8
cmp ecx, ebx
je 0x10066ac2
inc ecx
cmp byte [ecx], bl
je 0x10066ac2
mov eax, 0x1016a234
call fcn.1005a090
test eax, eax
je 0x10066b85
lea esi, [esp + 0x10]
call fcn.10062260
lea ecx, [esp + 0x11]
push ecx
mov edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x118], bl
jne 0x10066afd
mov eax, esi
push eax
push ebp
lea ecx, [esp + 0x228]
push str._s._s.mwt
push ecx
call fcn.10127dc0
add esp, 0x10
jmp 0x10066b27
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x42c]
push eax
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x22c]
push str._s_s._s.mwt
push edx
call fcn.10127dc0
add esp, 0x14
lea edi, [esp + 0x220]
mov ebx, ebp
call fcn.10066bf0
cmp eax, 1
jne 0x10066ba3
push 0
mov ecx, edi
call fcn.1005ece0
push 0
push 0
xor edx, edx
mov ecx, ebp
call fcn.10060eb0
add esp, 8
test eax, eax
jne 0x10066b85
lea eax, [esp + 0x10]
push eax
push ebp
mov ecx, edi
push str._s._s.mwt
push ecx
call fcn.10127dc0
add esp, 0x10
call fcn.10066bf0
cmp eax, 1
jne 0x10066be8
push 0
lea ecx, [esp + 0x224]
call fcn.1005ece0
mov eax, 1
mov ecx, dword [esp + 0x534]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x528
ret
cmp byte [esp + 0x118], 0
je 0x10066bd9
lea edx, [esp + 0x10]
push edx
push ebp
lea eax, [esp + 0x228]
push str._s._s.mwt
push eax
call fcn.10127dc0
add esp, 0x10
lea edi, [esp + 0x220]
call fcn.10066bf0
cmp eax, 1
je 0x10066b77
lea ecx, [esp + 0x220]
push ecx
mov ecx, ebp
call fcn.1005ece0
xor eax, eax
jmp 0x10066b8a