joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105a9a9
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1272524
call fcn.01160168
sub esp, 0x18
mov eax, dword [0x12cf8c8]
push ebx
push esi
push edi
push ecx
mov dword [ebp - 0x10], eax
mov esi, ecx
mov eax, esp
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esp
mov dword [eax], ebx
call fcn.0105a8d7
mov dword [ebp - 4], ebx
mov dword [esi], 0x1005670
mov dword [esi + 0x50], 0x100566c
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
lea ecx, [esi + 0x8c]
mov dword [esi + 0x88], ebx
call fcn.0105a91e
mov byte [ebp - 4], 1
mov eax, dword [0x12ce0a0]
lea ecx, [esi + 0xec]
mov dword [ecx], eax
mov byte [ebp - 4], 2
mov eax, dword [0x12ce0a0]
mov dword [esi + 0xf0], eax
mov byte [ebp - 4], 3
push 0x100548c
mov byte [esi + 0xf4], bl
call fcn.01032977
xor eax, eax
mov word [ebp - 0x1c], bx
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
jg 0x105aa6d
push 0x1005244
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esi + 0xec]
lea edi, [esi + 0xf0]
push eax
mov ecx, edi
call fcn.01044b40
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.010524f5
push 0x1005660
mov ecx, edi
call fcn.010524f5
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
call fcn.0115fe73
pop edi
pop esi
pop ebx
leave
ret

Function at 0x105b0df
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
push edi
mov byte [ebp - 1], 1
jne 0x105b136
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call edi
push eax
push 0x4e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x105b191
shr eax, 2
test al, 1
je 0x105b160
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
jmp 0x105b12e
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x24]
push 0x1005688
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x105b191
push 1
push ebx
push dword [esi + 4]
mov byte [esi + 0x48], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x105bd03
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
push edi
mov ebx, ecx
je 0x105bd20
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [esi], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jne 0x105bd35
push 0x100355c
jmp 0x105bd5b
lea eax, [edi + edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01160330
mov dword [ebp + 8], esp
inc edi
push edi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x105bd6c
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x105cb90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.010459bc
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push dword [ebp + 0xc]
push ebx
call esi
push 0xf0
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], ecx
je 0x105cbea
push eax
push ebx
call esi
push eax
mov dword [ebp - 4], eax
call edi
mov dword [ebp + 0xc], eax
cmp dword [ebp + 8], 0
je 0x105cc38
push dword [ebp + 8]
push ebx
call esi
push eax
mov dword [ebp + 8], eax
call edi
push dword [ebp + 0xc]
mov esi, eax
push esi
call fcn.0105c27a
push dword [ebp + 0x18]
mov edi, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
cmp edi, esi
mov dword [ebp - 8], eax
je 0x105cc2f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
je 0x105cc50
cmp dword [ebp - 0xc], 0
je 0x105cc50
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
leave
ret 0x14

Function at 0x1061b4d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1061b62
test al, 0x10
je 0x1061b62
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x1061be8
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4
Function at 0x1062500
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x800e
push 0
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x1062537
xor eax, eax
inc eax
jmp 0x1062595
push edi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x14]
and dword [ebp - 0x234], 0
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x23c], 0x1005688
mov dword [ebp - 0x22c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0115fe73
leave
ret 0x10

Function at 0x10627aa
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
push 0xd
mov edx, ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x104b
push dword [edx]
mov dword [ebp - 0x34], 4
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
pop edi
leave
ret 4
Function at 0x1063a07
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, 0x1272e0f
call fcn.01160168
sub esp, 0x630
mov eax, dword [0x12cf8c8]
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x218]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x800e
push ebx
call esi
test eax, eax
mov edi, 0x8005
jge 0x1063a51
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push edi
push ebx
call esi
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push 0x8037
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0x63c], eax
jge 0x1063a87
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push edi
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0x63c], eax
jl 0x1063bff
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x634], eax
mov dword [ebp - 4], ebx
push 0xf683
lea ecx, [ebp - 0x634]
call fcn.01032a95
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x630]
call fcn.01045d3e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x630]
call fcn.01044f6f
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x630]
call fcn.01044c82
lea ecx, [ebp - 0x630]
call fcn.01044f98
test eax, eax
jge 0x1063be2
push 0x104
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 1
jae 0x1063b0a
mov esi, 0x80004005
jmp 0x1063b65
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x638]
call fcn.01045d3e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62c]
call fcn.01044ec9
mov byte [ebp - 4], 3
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x638]
call fcn.010527df
mov esi, eax
cmp esi, ebx
jge 0x1063b86
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62c]
call fcn.010454b8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x638]
call fcn.010454b8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x630]
call fcn.010454b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x634]
call fcn.010328fa
mov eax, esi
jmp 0x1063c05
lea ecx, [ebp - 0x62c]
call fcn.01044f6f
push 0x10067c0
lea ecx, [ebp - 0x62c]
call fcn.010524f5
lea ecx, [ebp - 0x62c]
call fcn.01044f98
test eax, eax
jl 0x1063bc4
push 1
push dword [ebp - 0x630]
push dword [ebp - 0x62c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62c]
call fcn.010454b8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x638]
call fcn.010454b8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x630]
call fcn.010454b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x634]
call fcn.010328fa
mov eax, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret
Function at 0x1065dfd
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1273132
call fcn.01160168
sub esp, 0x254
mov eax, dword [0x12cf8c8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], ebx
mov byte [ebp - 4], 1
push ebx
push ebx
mov esi, 0xf003f
push esi
push ebx
push ebx
push eax
push 0x80000001
lea ecx, [ebp - 0x260]
call fcn.0106156f
cmp eax, ebx
je 0x1065e58
xor esi, esi
jmp 0x1065f28
push ebx
push ebx
push esi
push ebx
push ebx
push 0x10068dc
push dword [ebp - 0x260]
lea ecx, [ebp - 0x25c]
call fcn.0106156f
cmp eax, ebx
jne 0x1065e51
push 0x10068c0
push dword [edi + 0xc]
lea ecx, [ebp - 0x25c]
call fcn.010615c4
mov esi, dword [edi + 4]
jmp 0x1065ed4
push esi
push 0x10068a8
lea eax, [ebp - 0x50]
push 0x1f
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
lea eax, [esi + 0xe10f]
push eax
mov ecx, edi
mov word [ebp - 0x12], bx
call fcn.01065dc0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x25c]
call fcn.01044a7b
dec esi
cmp esi, ebx
jg 0x1065e8f
mov edi, dword [edi + 4]
lea esi, [edi + 1]
jmp 0x1065f0a
push esi
push 0x10068a8
lea eax, [ebp - 0x50]
push 0x1f
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x25c]
mov word [ebp - 0x12], bx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc esi
cmp esi, 0x10
jl 0x1065ee0
lea ecx, [ebp - 0x25c]
call fcn.010449c4
lea ecx, [ebp - 0x260]
call fcn.010449c4
xor esi, esi
inc esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x25c]
call fcn.010449c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.010449c4
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret 4
Function at 0x106b9b7
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1272cd1
call fcn.01160168
push ecx
push esi
mov esi, ecx
call fcn.0106baa4
test eax, eax
jge 0x106b9e0
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor al, al
jmp 0x106ba92
push ebx
push 0x640000
push 0
push 0x401
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x2bc
lea ecx, [ebp - 0x10]
call fcn.01032a95
test eax, eax
jne 0x106ba17
xor bl, bl
jmp 0x106ba83
push edi
push dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea ebx, [esi + 4]
push dword [ebx]
call edi
test eax, eax
jne 0x106ba30
xor bl, bl
jmp 0x106ba82
push 0
lea eax, [ebp - 0x10]
push 0xf1f7
push eax
call fcn.01053010
add esp, 0xc
test eax, eax
je 0x106ba2c
push dword [ebp - 0x10]
push dword [esi + 0x2c]
call edi
test eax, eax
je 0x106ba2c
push 0x2bd
lea ecx, [ebp - 0x10]
call fcn.01032a95
test eax, eax
je 0x106ba2c
push dword [ebp - 0x10]
push dword [esi + 0x30]
call edi
push 0
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, ebx
call fcn.01032626
mov bl, 1
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010328fa
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x106bc7a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
mov esi, ecx
push esi
push 0x106bcc2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x38], eax
jne 0x106bca4
xor al, al
jmp 0x106bcba
mov ecx, 0x12d2398
call fcn.0107d40a
push eax
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
pop esi
leave
ret

Function at 0x106c938
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1273b4c
call fcn.01160168
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0104db09
xor edi, edi
mov dword [ebp - 4], edi
lea ebx, [esi + 0xc]
mov ecx, ebx
call fcn.010687d3
mov byte [ebp - 4], 1
mov dword [esi + 0x30], edi
mov dword [esi], 0x1006c28
mov dword [ebx], 0x1006c18
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov byte [ebp - 4], 2
mov dword [esi + 0x54], edi
mov byte [ebp - 4], 3
mov dword [esi + 0x68], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x106e13d
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, esi
neg eax
sbb eax, eax
and eax, 4
push eax
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push 0xe801
lea ecx, [edi + 0x64]
call fcn.0106c4fb
push 1
lea ecx, [edi + 0x10]
call fcn.01050802
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x1073c1c
Capabilities:
Create thread

Disassembly:
mov eax, 0x127468d
call fcn.01160168
push ecx
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x24]
call fcn.010336a1
test eax, eax
jge 0x1073c32
xor al, al
jmp 0x1073ce1
and dword [ebp - 0x10], 0
push ebx
push edi
and dword [ebp - 4], 0
mov eax, dword [0x12d1f58]
push 0xf147
push dword [eax + 8]
lea ecx, [ebp - 0x10]
call fcn.01044959
push dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi + 0x38]
call edi
test eax, eax
jne 0x1073c67
xor bl, bl
jmp 0x1073cd0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1073c7f
push 5
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x100355c
lea ebx, [esi + 0x3c]
push dword [ebx]
call edi
test eax, eax
je 0x1073c63
push 0
mov eax, 0x4000
push eax
push eax
mov ecx, ebx
call fcn.01032b67
lea edi, [esi + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, edi
call fcn.01032626
lea eax, [ebp - 0x14]
push eax
xor edi, edi
push edi
push esi
push 0x1073bdc
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x4c], eax
je 0x1073c63
mov bl, 1
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1074175
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x12746d4
call fcn.01160168
sub esp, 0x218
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 4], esi
push 0x2001f
push eax
push dword [ebx]
lea ecx, [ebp - 0x214]
call fcn.010449e2
cmp eax, esi
jne 0x107421e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10741d5
lea eax, [ebp - 0x210]
push eax
call fcn.01074175
cmp eax, esi
jne 0x107421d
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x10741c5
call fcn.010449c4
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.010449c4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret 4
Function at 0x1074db3
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1274737
call fcn.01160168
sub esp, 0x218
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 0x10], eax
push esi
mov eax, ecx
lea esi, [eax + 0x84]
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01045d3e
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x220]
push eax
push ecx
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x224], esp
push eax
call fcn.01052598
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
call fcn.01183dc5
cmp eax, ebx
jge 0x10749f2
push dword [ebp - 0x220]
call fcn.0116ee83
pop ecx
push dword [esi]
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.010559c9
jmp 0x10749f4
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.010454b8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov al, bl
call fcn.0115fe73
pop esi
pop ebx
leave
ret
mov edi, edi
push esi
mov esi, ecx
call fcn.01074c12
test al, al
jne 0x1074dc3
pop esi
ret
mov ecx, esi
pop esi
jmp 0x1074958

Function at 0x107c32e
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov ecx, dword [ebp + 0x18]
mov eax, dword [0x12cf8c8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x214], ecx
push 0x104
lea ecx, [ebp - 0x20c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x107c3dd
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [ebp - 0x21c], eax
je 0x107c3dd
add eax, 3
and eax, 0xfffffffc
call fcn.01160330
test esp, esp
mov dword [ebp - 0x210], esp
je 0x107c3dd
push esp
push dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x107c3dd
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x1007ab8
push dword [ebp - 0x210]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x107c3e1
xor al, al
jmp 0x107c407
mov eax, dword [ebp - 0x218]
movsx ecx, word [eax + 0xa]
mov dword [esi], ecx
movsx ecx, word [eax + 8]
mov dword [edi], ecx
movsx ecx, word [eax + 0xe]
mov dword [ebx], ecx
movsx eax, word [eax + 0xc]
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
mov al, 1
lea esp, [ebp - 0x230]
mov ecx, dword [ebp - 4]
call fcn.0115fe73
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x107cd20
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 0x90], eax
jne 0x107cd45
xor al, al
jmp 0x107cd70
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x107beff
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
setne byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x107cd6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret

Function at 0x107d75d
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, 0x1275170
call fcn.01160168
push ecx
push esi
push edi
xor edi, edi
cmp dword [0x12d2b08], edi
mov esi, 0x12d2900
jne 0x107d7f5
push 1
push 0x1c
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x107d7f5
push esi
lea ecx, [ebp - 0x10]
call fcn.01045d3e
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x10]
call fcn.01044f6f
push 0x1008218
lea ecx, [ebp - 0x10]
call fcn.010524f5
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, edi
jne 0x107d7be
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x10]
call fcn.01044f6f
push 0x103
push dword [ebp - 0x10]
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov word [0x12d2b06], di
mov dword [0x12d2b08], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010454b8
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1082792
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 1
mov edi, ecx
call esi
mov ecx, edi
mov dword [ebp - 0xc], eax
call fcn.01044f98
test eax, eax
mov eax, dword [edi]
setge byte [ebp - 1]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x10827e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], 0
jne 0x10827fa
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0xc]
call esi
test ebx, ebx
je 0x1082815
jle 0x1082811
and ebx, 0xffff
or ebx, 0x80070000
mov eax, ebx
jmp 0x1082817
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1082f2a
Capabilities:
Delete file

Disassembly:
mov eax, 0x1275a0a
call fcn.01160168
sub esp, 0x24
mov ecx, dword [ebp + 8]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
add ecx, 0xc
call fcn.0117e889
test eax, eax
jl 0x1083019
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x1082f63
mov eax, 0x80004003
jmp 0x1083019
push esi
call fcn.0117baef
test eax, eax
je 0x1083016
mov ecx, dword [ebp - 0x10]
call fcn.0117c106
test eax, eax
jl 0x1083018
mov ecx, dword [ebp - 0x10]
call fcn.0117baef
push eax
lea ecx, [ebp + 8]
call fcn.01045d3e
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0107bfb4
mov eax, dword [ebp + 8]
mov esi, dword [eax - 8]
lea eax, [esi + 1]
push eax
lea ecx, [ebp + 8]
call fcn.0103299e
mov edx, eax
test edx, edx
jne 0x1082fbd
mov esi, 0x8007000e
jmp 0x1082ff0
and word [edx + esi*2], 0
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], edx
mov word [ebp - 0x20], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
pop edi
jge 0x1083000
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.010454b8
mov eax, esi
jmp 0x1083018
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.01032a0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.010454b8
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4