joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ba8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
and byte [ebp - 0x108], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.00402a0b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
mov dword [esp], 0x40b164
push eax
call edi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402ccf
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.00402a0b
pop ecx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
mov eax, dword [ebp - 0x248]
test al, 1
je 0x402c73
dec eax
mov dword [ebp - 0x248], eax
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x248]
and eax, 0x10
test al, al
jne 0x402c89
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402ca8
cmp byte [ebp - 0x21c], 0x2e
je 0x402ca8
lea eax, [ebp - 0x108]
push eax
call fcn.00402ba8
pop ecx
lea eax, [ebp - 0x108]
push eax
call ebx
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402c25
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call ebx
pop ebx
pop edi
pop esi
leave
ret

Function at 0x402cd3
Capabilities:
Get file size

Disassembly:
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push 1
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402d00
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x402d14
mov dword [eax], esi
jmp 0x402d14
push dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
ret
Function at 0x407d40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push str.QuickTime.qts
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x407d88
lea ecx, [esp + 0x10]
push 0x104
push ecx
push eax
call esi
test eax, eax
jbe 0x407d88
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jbe 0x407e1c
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0xf]
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x407e1c
mov cl, byte [eax]
cmp cl, 0x5c
je 0x407dd1
cmp cl, 0x2f
je 0x407dd1
dec eax
lea edx, [esp + 0x10]
cmp eax, edx
jae 0x407dba
jmp 0x407e1c
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x407e1c
mov byte [eax + 1], 0
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov ebx, eax
test ebx, ebx
jne 0x407e9c
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x407e9c
mov edi, 0x40b1dc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
nop
mov ebx, 0x40915c
mov ecx, 0x5d0e71cb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..7LWLf
mov ebx, 0x42f3f8
nop
mov ecx, 0x4e0f645f
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x12422a10
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x12422a5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x12422a5b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.1246f55f
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.1246f55f
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x12422aa0
test esi, esi
je 0x12422ab1
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x12422aad
push esi
call fcn.1246f3e6
add esp, 4
test ebx, ebx
jne 0x12422ac0
mov edi, dword [edi]
test edi, edi
je 0x12422ac0
push edi
call fcn.1246f3e6
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret

Function at 0x12423ba0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4b8
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x12423c93
mov eax, dword [esp + 0x4d0]
test eax, eax
je 0x12423c93
lea eax, [esp + 0xe0]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x12423c7d
cmp word [esp + 0xe0], 0
je 0x12423c7d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [esp + 0xe0]
lea esi, [esp + 0xe0]
push 0x124f471c
push eax
call ebx
test eax, eax
je 0x12423c72
push 0x124f4714
push esi
call ebx
test eax, eax
je 0x12423c72
mov cx, word [esi]
mov dx, word [esi + 2]
mov word [esp + 0x10], cx
lea eax, [esp + 0x18]
push 0x64
lea ecx, [esp + 0x14]
push eax
push ecx
mov word [esp + 0x1e], dx
mov word [esp + 0x20], 0
call ebp
test eax, eax
je 0x12423c93
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x4cc]
mov edi, eax
lea eax, [esp + 0x18]
push edi
push eax
push ecx
call fcn.1246f723
add esp, 0xc
test eax, eax
je 0x12423ca0
add esi, 8
mov eax, esi
cmp word [esi], 0
jne 0x12423c09
mov edx, dword [esp + 0x4cc]
mov eax, dword [esp + 0x4d0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4b8
ret
mov esi, dword [esp + 0x4d0]
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x4cc]
lea ecx, [eax + edi*2]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4b8
ret
Function at 0x12424fe0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x124d3718
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov edi, dword [esp + 0x44]
test edi, edi
jne 0x12425015
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x38
ret
push 0
push 0
lea eax, [esp + 0x4c]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push edi
mov esi, 1
call fcn.1248b570
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x24]
add esp, 0x1c
push edx
push eax
push str.CheckFileSize_________dwSizeLow:_d___dwSizeHigh:_d_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
mov eax, dword [0x12515c2c]
add esp, 0x18
test eax, eax
jne 0x124250b8
lea ecx, [esp + 0x10]
call fcn.12445980
push ecx
mov dword [esp + 0x40], 0
mov ecx, esp
mov dword [esp + 0x10], esp
push str.maxsize_historyfile
call fcn.12456050
lea ecx, [esp + 0x14]
call fcn.12445b70
lea ecx, [esp + 0x10]
call fcn.12445ff0
test eax, eax
je 0x124250a1
shl eax, 0xa
mov dword [0x124f33a0], eax
lea ecx, [esp + 0x10]
mov dword [0x12515c2c], esi
mov dword [esp + 0x3c], 0xffffffff
call fcn.12445ad0
mov ecx, dword [0x124f33a0]
push ecx
push str.CheckFileSize__History_File_Max_Size_:__d_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
mov eax, dword [esp + 0x58]
add esp, 0x14
test eax, eax
ja 0x124250ed
mov edx, dword [esp + 8]
mov eax, dword [0x124f33a0]
cmp edx, eax
jb 0x1242511a
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x124250ff
push str.CheckFileSize__DeleteFile_success_
jmp 0x12425106
xor esi, esi
push str.CheckFileSize__DeleteFile_failed_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
add esp, 0x10
push esi
push str.CheckFileSize_____bRet:_d_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
mov ecx, dword [esp + 0x48]
add esp, 0x14
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x38
ret
Function at 0x12425400
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x124d3778
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebp
push esi
push edi
mov edi, dword [esp + 0x60]
xor ebp, ebp
test edi, edi
je 0x1242550a
push ebp
push ebp
push 3
push ebp
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push edi
push esi
push str.IsSqlFile___08x___s_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
add esp, 0x18
cmp esi, 0xffffffff
je 0x1242550a
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str.SQLite_format
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x60], eax
push eax
lea eax, [esp + 0x64]
mov edi, ecx
push eax
lea ecx, [esp + 0x18]
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x12425503
push edi
lea edx, [esp + 0x14]
push str.SQLite_format
push edx
call fcn.1247fd70
add esp, 0xc
test eax, eax
jne 0x124254bf
mov ebp, 1
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
call fcn.12455ef0
mov ecx, dword [eax]
push ebp
push ecx
push 0x124f4cc8
push str.History
push 0xffffffffffffffff
push 0x1251696c
mov dword [esp + 0x70], 0
call fcn.12447cf0
add esp, 0x18
lea ecx, [esp + 0xc]
mov dword [esp + 0x58], 0xffffffff
call fcn.124567f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x50]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x50
ret
Function at 0x12426890
Capabilities:
Copy file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x124d37e8
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
mov eax, dword [ebx + 8]
cmp eax, 0x16
jne 0x124268cb
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
push eax
push ecx
lea esi, [ebx + 0x48]
mov ecx, esp
mov dword [esp + 0x34], esp
push esi
xor edi, edi
call fcn.12456050
lea eax, [esp + 0x34]
push eax
call fcn.124297c0
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], edi
push ecx
push edi
push edi
push edi
push edi
push edi
push esi
call fcn.1248b570
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x34]
push edx
push edi
push edi
push edi
push edi
push edi
push eax
call fcn.1248b570
add esp, 0x44
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
je 0x1242692c
mov edi, 1
cmp dword [ebx + 8], 0x13
jne 0x1242694f
call fcn.12425750
test eax, eax
jne 0x1242694f
push esi
call fcn.12425800
add esp, 4
test eax, eax
je 0x1242694f
mov edi, 1
jmp 0x12426953
test edi, edi
je 0x1242696e
push esi
call fcn.12424fe0
add esp, 4
test eax, eax
je 0x1242696e
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x2c]
push edi
push ecx
push esi
push str.CopyHistoryByCompareFileTime_wszFilePath__s__wstrFilePath1__s_bCopy__lu_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
add esp, 0x1c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.124567f0
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x1242c460
Capabilities:
Link many functions at runtime

Disassembly:
call fcn.12448e30
mov dword [0x1251be0c], eax
mov dword [0x1251c438], eax
mov ecx, 0x12516288
jmp fcn.1242f850
Function at 0x1242f850
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x1242f87a
push str.winbrosqlite3_module_is_Loaded
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
add esp, 0x10
mov eax, 1
pop esi
ret
push str.winbrosqlite3.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x28], eax
jne 0x1242f8b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.winbrosqlite3_module_load_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
add esp, 0x14
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sqlite3_open16
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_prepare16_v2
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_bind_int64
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_bind_text16
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_step
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_column_int64
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_column_text16
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_close
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_finalize
push ecx
mov dword [esi + 0x20], eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
test ecx, ecx
pop edi
je 0x1242f992
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1242f992
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1242f992
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1242f992
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1242f992
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x1242f992
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x1242f992
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1242f992
test eax, eax
je 0x1242f992
push str.winbrosqlite3_module_load_successful
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
add esp, 0x10
mov eax, 1
mov dword [esi + 0x2c], eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_winbrosqlite3_function_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x1251696c
call fcn.12447cf0
add esp, 0x14
mov ecx, esi
call fcn.1242f9c0
xor eax, eax
pop esi
ret
Function at 0x12431c00
Capabilities:
Enumerate gui resources

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, 8
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
push esi
push 0x12431ba0
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret

Function at 0x12432030
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x12432068
lea ecx, [esp + 4]
push ecx
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x124320a2
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1243207f
push esi
call fcn.1246f510
add esp, 4
lea eax, [eax + eax + 2]
jmp 0x12432081
xor eax, eax
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc

Function at 0x124320b0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x124320e8
lea ecx, [esp + 4]
push ecx
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1243210e
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret 0xc

Function at 0x12432120
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
xor esi, esi
push edi
push SysStringLen
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1243215d
lea ecx, [esp + 8]
push ecx
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x124321dd
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push edi
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x124321c7
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.1246f55f
mov esi, eax
add esp, 4
test esi, esi
je 0x124321c7
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
Function at 0x124321f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
xor esi, esi
push edi
push SysStringLen
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x12432229
lea ecx, [esp + 8]
push ecx
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x124322a2
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push edi
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 1
jb 0x1243228c
inc eax
push eax
mov dword [esp + 0x1c], eax
call fcn.1246f55f
mov esi, eax
add esp, 4
test esi, esi
je 0x1243228c
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push esi
push eax
push 0
push edi
push ecx
call ebx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
add esp, 8
ret 8

Function at 0x124322b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
push esi
push SysStringLen
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x124322f2
lea ecx, [esp + 4]
push ecx
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1243232e
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
pop esi
add esp, 0xc
ret 8