joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10112efb
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
mov esi, 0x10047bd8
push edi
mov edi, edx
test ebx, ebx
jne 0x10112f2d
push 0x100499a8
mov edx, 0x95e
mov ecx, esi
call fcn.100e970f
test edi, edi
jne 0x10112f42
push 0x100499b4
mov edx, 0x95f
mov ecx, esi
call fcn.100e970f
xor eax, eax
mov ecx, ebx
mov dword [ebp - 8], eax
call fcn.100b5558
mov dword [ebp - 4], eax
test eax, eax
jne 0x10112f75
push ebx
mov esi, 0x80070057
push 0x10048e80
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x101130b7
mov ecx, edi
call fcn.100ec268
mov esi, eax
test esi, esi
jns 0x10112f8a
push edi
push 0x10020890
jmp 0x10112f60
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10112f91
push dword [ebp - 4]
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x10112fb7
mov edx, edi
lea ecx, [ebp - 8]
call fcn.100a9500
jmp 0x10112fc9
push edi
lea eax, [ebp - 8]
push 0x10008194
push eax
call fcn.100a6b40
add esp, 0x10
mov esi, eax
test esi, esi
jns 0x10112fec
push 0x100499c4
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 8]
add esp, 0x10
jmp 0x101130a9
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1011301e
push 0x80
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
push edi
push 0x100499e4
xor eax, eax
push eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x10113028
mov ebx, dword [ebp - 0xc]
push 0x100
push eax
push eax
push eax
push edi
push ebx
call dword [sym.imp.api_ms_win_core_kernel32_private_l1_1_1.dll_PrivCopyFileExW]
test eax, eax
jne 0x1011308c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x20
jne 0x10113092
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov eax, dword [ebp - 4]
inc eax
push 0
mov dword [ebp - 4], eax
cmp eax, 0xa
pop eax
jl 0x10113025
movzx esi, bx
or esi, 0x80070000
push edi
push dword [ebp - 0xc]
push 0x10020854
push 0x10049a04
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x1c
jmp 0x101130a9
xor ecx, ecx
mov ebx, ecx
jmp 0x10113094
xor ecx, ecx
test ebx, ebx
je 0x1011309e
jg 0x10113063
mov esi, ebx
jmp 0x1011306c
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x101130a9
mov dword [eax], edi
mov edi, ecx
test edi, edi
je 0x101130b7
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1011345f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x10047bd8
mov dword [ebp - 0x10], edi
jne 0x1011348b
push 0x10035fec
mov edx, 0x685
mov ecx, ebx
call fcn.100e970f
cmp dword [ebp + 0x10], 0
jne 0x101134a2
push 0x100203f0
mov edx, 0x686
mov ecx, ebx
call fcn.100e970f
mov esi, dword [ebp + 0x18]
test esi, esi
jne 0x101134ba
push 0x10009da4
mov edx, 0x687
mov ecx, ebx
call fcn.100e970f
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 8]
xor eax, eax
mov ebx, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], eax
mov dword [esi], eax
call fcn.10115504
mov esi, eax
test esi, esi
jns 0x101134f4
push 0x1004875c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x101135f5
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x101134fe
mov eax, dword [edi + 8]
push dword [ebp - 8]
push eax
lea eax, [ebp - 4]
push 0x10048788
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x10113548
push 0x100487a4
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 4]
add esp, 0x10
test edi, edi
je 0x101135e7
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
jmp 0x101135e7
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x101135e2
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 4
jne 0x1011360f
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push 0x100487d4
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x1011359c
push 0x100487ec
push 1
push esi
push 0x4000000
call fcn.100ab973
mov ebx, dword [ebp - 0xc]
add esp, 0x10
jmp 0x10113531
mov ebx, dword [ebp - 0xc]
mov edx, ebx
mov ecx, dword [ebp + 8]
push 0
push 0x1004881c
call fcn.10113ea1
test eax, eax
js 0x1011360f
mov eax, dword [ebp + 8]
push ebx
push dword [eax + 0x188]
lea eax, [ebp - 4]
push 0x100082dc
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x101135df
push 0x10048840
jmp 0x1011351e
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
test ebx, ebx
je 0x101135f5
lea eax, [ebx - 4]
push eax
call fcn.100b84f9
pop ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x10113606
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
cmp dword [ebp + 0x14], 0
je 0x10113531
push edi
xor eax, eax
push 0x10048868
push eax
push eax
push 0x4000000
mov dword [ebp - 0xc], eax
call fcn.100ab973
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0xc]
add esp, 0x14
call fcn.10115fa5
test eax, eax
jne 0x10113659
push dword [ebp - 0xc]
push 0x10048898
push eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0xc]
mov dword [eax], edi
call fcn.100b61be
jmp 0x101135e7
Function at 0x10116185
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
push 5
push eax
push 1
push ecx
xor esi, esi
mov word [eax], dx
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
test eax, eax
jne 0x101161d9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x101161b7
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x101161c4
mov esi, 0x80004005
mov eax, esi
push 0x10048b0c
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x1011750a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
mov esi, edi
cmp dword [ebp + 8], esi
jne 0x1011752f
cmp dword [0x101dea4c], esi
je 0x1011752f
mov edi, 0x8007045b
jmp 0x101175b6
test cl, 1
je 0x1011759b
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
add eax, 4
add eax, ebx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x101e07c0]
call esi
push edi
push edi
push ebx
push 0x10117160
push edi
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x101175a6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x10117577
movzx eax, ax
or eax, 0x80070000
mov edi, eax
test eax, eax
js 0x10117584
mov edi, 0x80004005
mov eax, edi
push 0x10049dbc
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x101175a2
call fcn.101175bf
mov edi, eax
test esi, esi
je 0x101175b6
push esi
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x101175b6
push 7
pop ecx
int 0x29
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1011b38e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x40], 0x1011b000
mov dword [edi + 0x44], eax
cmp dword [ebp + 0x10], ebx
jbe 0x1011b3f6
mov ebx, dword [ebp + 0x14]
lea eax, [edi + 0x48]
push dword [eax + 0xc]
mov ecx, eax
push ebx
call fcn.1011b538
mov esi, eax
test esi, esi
jns 0x1011b3e2
push 0x10009b38
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
test esi, esi
js 0x1011b42e
mov eax, dword [ebp - 4]
add ebx, 2
inc eax
cmp eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [edi + 0x48]
jb 0x1011b3b8
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x1011b438
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1011b41a
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x1011b427
mov esi, 0x80004005
mov eax, esi
push 0x1004b674
jmp 0x1011b484
push 0x1004b65c
push 1
push esi
jmp 0x1011b487
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [edi + 0x20], eax
test eax, eax
je 0x1011b408
push ebx
push ebx
push edi
push 0x1011b7a0
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov dword [edi + 0x18], eax
test eax, eax
jne 0x1011b494
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1011b472
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x1011b47f
mov esi, 0x80004005
mov eax, esi
push 0x1004b694
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1011bdd6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
test eax, eax
jne 0x1011bdf9
mov eax, 0x1004be5c
push eax
push 0x1004be68
sub esp, 0x10
mov esi, 0x1002ef58
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100ea948
mov esi, dword [ebp + 0x18]
add esp, 0x18
mov ecx, esi
call fcn.1011cbdc
test eax, eax
je 0x1011be69
push esi
push 0x1004b928
push 0
push 0
mov edi, 0x4000000
push edi
call fcn.100ab973
mov edx, dword [ebp + 0x14]
add esp, 0x14
mov ecx, esi
call fcn.100f2a7c
mov ebx, eax
test ebx, ebx
jns 0x1011bf1e
push dword [ebp + 0x14]
push esi
push 0x1004bec4
push 1
push ebx
push edi
call fcn.100ab973
add esp, 0x18
jmp 0x1011bf54
push dword [ebp + 0x1c]
mov edx, dword [ebp - 0xc]
mov ecx, ebx
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1011bf83
mov ebx, eax
test ebx, ebx
jns 0x1011bea4
push esi
push 0x1004bc50
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x1011bf54
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push 0x1004bb24
call fcn.100a9500
mov ebx, eax
test ebx, ebx
jns 0x1011bed1
push 0x1004bb4c
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x1011bf43
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1011bf1e
cmp eax, 0x10
je 0x1011bf1e
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 1]
mov byte [ebp - 1], 0
call fcn.1011bcdc
test eax, eax
js 0x1011bf5d
cmp byte [ebp - 1], 0
je 0x1011bf5d
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x268], 1
push 0x1004bf28
push 0
push 0
push 0x4000000
call fcn.100ab973
add esp, 0x10
test esi, esi
jne 0x1011bf27
mov esi, 0x1004be5c
push esi
push 0x1004bf50
sub esp, 0x10
mov esi, 0x1002ee48
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100ea948
add esp, 0x18
mov eax, dword [ebp - 8]
test eax, eax
je 0x1011bf54
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18
push dword [ebp + 0x1c]
mov edx, dword [ebp - 0xc]
push edi
push ecx
push dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1011c17b
mov ebx, eax
test ebx, ebx
jns 0x1011bf08
push 0x1004bf00
jmp 0x1011bebf
Function at 0x1011c17b
Capabilities:
Delete file
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x410], eax
mov edi, 0x1fe
mov eax, dword [ebp + 0x14]
xor esi, esi
mov dword [ebp - 0x414], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x208]
push esi
push eax
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x40c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x408]
push edi
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
xor ebx, ebx
inc ebx
push ebx
jmp 0x1011c2c4
push dword [ebp - 0x414]
lea eax, [ebp - 0x408]
push 0xff
push eax
push 0
lea eax, [ebp - 0x208]
push eax
push 0x1004bbe0
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1011c2fc
mov edx, dword [ebp - 0x410]
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x40c]
call fcn.100a9500
mov edi, eax
test edi, edi
js 0x1011c334
push dword [ebp - 0x418]
mov esi, dword [ebp - 0x40c]
xor eax, eax
mov edx, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x420]
push esi
push dword [ebp - 0x410]
push eax
push eax
push eax
call fcn.1011bf83
mov edi, eax
push esi
test edi, edi
js 0x1011c31d
push 0x1004bc98
xor edi, edi
push edi
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x14
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x1011c2ac
push esi
push 0x1004bc7c
push edi
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x14
test esi, esi
je 0x1011c2c2
lea eax, [esi - 4]
push eax
call fcn.100b84f9
mov esi, edi
pop ecx
mov dword [ebp - 0x40c], esi
inc ebx
push ebx
push 0x1004bbac
lea eax, [ebp - 0x208]
push 0xff
push eax
call fcn.100e3885
mov edi, eax
add esp, 0x10
test edi, edi
jns 0x1011c1f2
push 0x1004bbc4
push 1
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x10
test esi, esi
je 0x1011c30a
lea eax, [esi - 4]
push eax
call fcn.100b84f9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0x14
push 0x1004bc50
push 1
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x1011c2fc
push 0x1004bbf0
push 1
push edi
push 0x4000000
call fcn.100ab973
mov esi, dword [ebp - 0x40c]
jmp 0x1011c2f9
Function at 0x1011c553
Capabilities:
Check if file exists
Delete file
Get file attributes
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x41c], eax
mov ebx, 0x208
mov eax, dword [ebp + 0x10]
xor esi, esi
and dword [ebp - 0x420], esi
push edi
mov dword [ebp - 0x424], eax
mov edi, ecx
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x210]
push esi
push eax
mov dword [ebp - 0x42c], edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push ebx
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, dword [ebp - 0x424]
xor ebx, ebx
add esp, 0xc
inc ebx
cmp dword [eax + 0xc], esi
je 0x1011c798
cmp byte [edi + 0x268], 0
jne 0x1011c5e2
push 0x1004bb08
jmp 0x1011c783
mov edi, dword [ebp - 0x41c]
lea ecx, [ebp - 0x420]
push 0x1004bb24
mov edx, edi
call fcn.100a9500
mov esi, eax
test esi, esi
jns 0x1011c60a
push 0x1004bb4c
jmp 0x1011c788
push dword [ebp - 0x420]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1011c77e
cmp eax, 0x10
je 0x1011c77e
and dword [ebp - 0x41c], 0
lea eax, [ebp - 0x210]
push ebx
push 0x1004bbac
push 0x104
push eax
call fcn.100e3885
mov esi, eax
add esp, 0x10
test esi, esi
js 0x1011c75c
push dword [ebp - 0x420]
lea eax, [ebp - 0x418]
push 0x104
push eax
push 0
lea eax, [ebp - 0x210]
push eax
push 0x1004bbe0
call dword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x41c]
test eax, eax
je 0x1011c777
lea eax, [ebp - 0x418]
mov edx, edi
push eax
call fcn.100a9500
mov esi, eax
test esi, esi
js 0x1011c755
mov esi, dword [ebp - 0x424]
xor eax, eax
cmp dword [esi + 0xc], eax
je 0x1011c6e9
push dword [ebp - 0x41c]
push 0x1004bc24
push eax
push eax
push 0x4000000
call fcn.100ab973
mov ecx, dword [ebp - 0x41c]
add esp, 0x14
mov edx, edi
push dword [ebp - 0x428]
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x42c]
call fcn.1011c34e
mov esi, eax
test esi, esi
js 0x1011c738
push dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x1011c727
mov esi, dword [ebp - 0x41c]
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1011c711
movzx eax, ax
or eax, 0x80070000
push esi
push 0x1004bc7c
push 1
push eax
push 0x2000000
call fcn.100ab973
add esp, 0x14
lea ecx, [ebp - 0x41c]
inc ebx
call fcn.100b61be
jmp 0x1011c628
push dword [ebp - 0x41c]
push 0x1004bc50
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x1011c771
push 0x1004bbf0
jmp 0x1011c761
push 0x1004bbc4
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
lea ecx, [ebp - 0x41c]
call fcn.100b61be
jmp 0x1011c798
push 0x1004bb80
mov esi, 0x80070057
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
lea ecx, [ebp - 0x420]
call fcn.100b61be
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0x10
Function at 0x1011e745
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jne 0x1011e776
push 0x1004d918
mov edx, 0xfa
mov ecx, 0x1004d6d0
call fcn.100e970f
xor edx, edx
test ebx, ebx
mov esi, edx
setne cl
call fcn.1011e927
mov dword [ebp - 8], edx
test al, al
je 0x1011e86e
mov dword [ebp - 0x1c], edx
test ebx, ebx
jne 0x1011e7d1
lea ecx, [ebp - 0x1c]
call fcn.100f1e5c
mov esi, eax
test esi, esi
jns 0x1011e7ce
push 0x1004d76c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
lea ecx, [ebp - 0x1c]
call fcn.100b61be
lea ecx, [ebp - 8]
call fcn.100b61be
jmp 0x1011e914
mov ebx, dword [ebp - 0x1c]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.100a7590
mov esi, eax
push edi
test esi, esi
jns 0x1011e7f9
push 0x1004d800
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x1011e7b9
mov edx, 0x1004d788
lea ecx, [ebp - 8]
call fcn.100a9500
mov esi, eax
test esi, esi
jns 0x1011e814
push edi
push 0x1004d848
jmp 0x1011e7e7
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x1011e7b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp byte [ebp + 8], 0
je 0x1011e840
cmp eax, 2
jne 0x1011e840
xor esi, esi
push 0x1004d928
push esi
push esi
jmp 0x1011e7ac
test eax, eax
jns 0x1011e7b9
push dword [ebp - 8]
mov esi, eax
push edi
push 0x1004d95c
push 1
or esi, 0x10000000
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x18
jmp 0x1011e7b9
push ecx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf750e6c3
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], 0x11d138ee
mov dword [ebp - 0x10], 0xc000e585
mov dword [ebp - 0xc], 0xee95c24f
call fcn.1011e342
test eax, eax
jne 0x1011e8d3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1011e8b1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1011e8b8
mov esi, 0x80004005
push 0x1004d718
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp dword [ebp - 8], 0
jmp 0x1011e90a
push ecx
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.1011e39f
test eax, eax
jne 0x1011e907
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1011e8f9
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1011e900
mov esi, 0x80004005
push 0x1004d994
jmp 0x1011e8bd
cmp dword [ebp - 8], esi
je 0x1011e914
push dword [ebp - 8]
call fcn.1011e3ca
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 4
Function at 0x1011ec61
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x210], ecx
test edi, edi
jne 0x1011ec9d
push 0x1002fb40
mov edx, 0x296
mov ecx, 0x1004dc34
call fcn.100e970f
and dword [ebp - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
push 8
push 0
mov edx, edi
mov dword [ebp - 0x208], 0xff
mov ecx, ebx
call fcn.100afca4
mov esi, eax
test esi, esi
je 0x1011ed1d
jle 0x1011ecd3
movzx esi, si
or esi, 0x80070000
push edi
push 0x1002fb4c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x1011ed80
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
push dword [ebp + 8]
call fcn.1011ec61
mov esi, eax
test esi, esi
js 0x1011eda8
mov dword [ebp - 0x208], 0xff
xor esi, esi
lea eax, [ebp - 0x208]
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x1011ecee
cmp dword [ebp - 0x20c], esi
je 0x1011ed5c
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [ebp - 0x20c], esi
push esi
push edi
mov edx, ebx
call fcn.100e6e49
mov esi, eax
test esi, esi
jns 0x1011ed80
push 0x1002fb8c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp dword [ebp - 0x20c], 0
je 0x1011ed95
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc
lea eax, [ebp - 0x204]
push eax
push 0x1002fb64
jmp 0x1011ecd9

Function at 0x1011ee21
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, dword [ebp + 0xc]
xor eax, eax
push edi
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0xff
push eax
lea eax, [ebp - 0x204]
mov edi, ecx
push eax
push dword [ebp + 8]
push dword [edi + 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jg 0x1011ee70
mov esi, eax
jmp 0x1011ee79
movzx esi, ax
or esi, 0x80070000
cmp eax, 0x103
je 0x1011eed0
cmp eax, 3
je 0x1011ee8a
cmp eax, 2
jne 0x1011ee8f
mov esi, 0x80070490
test esi, esi
jns 0x1011ee9d
push dword [edi + 8]
push 0x1004db78
jmp 0x1011eec0
push ebx
push 0
lea eax, [ebp - 0x204]
mov ecx, edi
push eax
call fcn.1011f03e
mov esi, eax
test esi, esi
jns 0x1011eed0
lea eax, [ebp - 0x204]
push eax
push 0x1004dba4
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 8