joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100053e9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x14], edi
mov dword [ebp - 4], edi
mov ebx, 0x2001f
mov dword [ebp - 8], edi
je 0x10005408
mov ebx, 0x2011f
lea eax, [ebp - 8]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1000543c
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000546f
cmp dword [ebp + 0x10], edi
je 0x10005451
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
jmp 0x10005453
xor eax, eax
push eax
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10005476
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x14], edi
mov dword [ebp - 4], edi
mov ebx, 0x2001f
mov dword [ebp - 8], edi
je 0x10005495
mov ebx, 0x2011f
lea eax, [ebp - 8]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100054c9
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100054e7
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100054ee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x18], edi
mov dword [ebp - 4], edi
mov ebx, 0x2001f
mov dword [ebp - 8], edi
je 0x1000550d
mov ebx, 0x2011f
lea eax, [ebp - 8]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10005541
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000555f
lea eax, [ebp + 0x10]
push 8
push eax
push 3
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10005566
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp + 8]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1000559e
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100055f5
lea eax, [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 8]
push edi
push eax
push edi
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 8]
cmp eax, 2
jb 0x100055ec
inc eax
inc eax
mov dword [ebp + 8], eax
shr eax, 1
add eax, eax
push eax
call sub.MFC42.DLL_operatornew
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x100055ec
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push ebx
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 8

Function at 0x100055fe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10005636
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10005664
lea eax, [ebp + 8]
and dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 8], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret 8

Function at 0x1000566c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
fldz
push esi
fstp qword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x100056a5
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100056d3
lea eax, [ebp + 8]
and dword [ebp - 8], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 8], 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld qword [ebp - 0x10]
pop esi
leave
ret 8
Function at 0x10005758
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x10054d48
call fcn.10013ac0
sub esp, 0x65c
push esi
mov esi, ecx
push 1
call fcn.10005a9d
test eax, eax
mov dword [ebp - 0x10], eax
je 0x10005888
and word [ebp - 0x460], 0
push edi
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x45e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x460]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.10005c4f
and word [ebp - 0x668], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x666]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x668]
push dword [ebp - 0x10]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
and dword [ebp - 0x260], 0
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x25c]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000587e
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x234]
push 0x10061a40
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10005865
lea eax, [ebp - 0x234]
push 0x10061a3c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10005865
test byte [ebp - 0x260], 0x10
jne 0x10005865
lea eax, [ebp - 0x234]
lea ecx, [ebp + 8]
push eax
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 8]
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
push ecx
push eax
mov ecx, esi
call sub.MFC42.DLL_CStringArray::SetAtGrow
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100135b2
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10005802
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x10]
call sub.MFC42.DLL_operatordelete
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x10009603
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call sub.MSVCRT.dll_strlen
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x1000963b
push 1
pop eax
jmp 0x100096e2
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x100096a6
cmp byte [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x10009661
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x1000965d
cmp byte [edi + 0x2e], 0
je 0x100096be
test al, al
je 0x100096be
push ecx
call sub.MSVCRT.dll_strlen
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x100096be
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call sub.MSVCRT.dll_strcat
push 0x100622e8
push esi
call sub.MSVCRT.dll_strcat
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.10009603
add esp, 0x20
mov byte [ebx + esi - 1], 0x2a
and byte [ebx + esi], 0
mov dword [ebp + 8], eax
jmp 0x100096be
push dword [ebp + 0x14]
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov byte [ebx + esi - 1], 0x2a
cmp dword [ebp + 8], 0
je 0x100096d6
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009642
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100097a7
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov eax, 0x1f3
pop ecx
sub eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x100097e2
push 1
pop eax
jmp 0x100098a5
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcscat]
mov dword [ebp + 0xc], 1
test byte [ebx], 0x10
je 0x1000985f
cmp word [ebx + 0x2c], 0x2e
lea ecx, [ebx + 0x2c]
jne 0x10009815
mov ax, word [ebx + 0x2e]
cmp ax, 0x2e
jne 0x10009810
cmp word [ebx + 0x30], 0
je 0x10009880
test ax, ax
je 0x10009880
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
inc eax
pop ecx
cmp dword [ebp - 8], eax
jb 0x10009880
mov eax, dword [ebp + 8]
and word [esi + eax*2 - 2], 0
lea eax, [ebx + 0x2c]
push eax
push esi
call edi
push 0x100622ec
push esi
call edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push esi
call fcn.100097a7
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
add esp, 0x20
mov word [esi + eax*2 - 2], 0x2a
and word [esi + eax*2], 0
jmp 0x10009880
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
and word [esi + eax*2 - 2], 0
lea eax, [ebx + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov word [esi + eax*2 - 2], 0x2a
cmp dword [ebp + 0xc], 0
je 0x10009898
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100097f0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009fc0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000a12d
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x1000a12d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000a12d
test bl, 1
je 0x1000a007
and ebx, 0xfffffffe
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x1000a124
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push esi
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x104]
push 0x100622e8
push eax
call sub.MSVCRT.dll_strcat
and dword [ebp - 0x244], 0
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x240]
push 0x4f
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000a11a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x218]
push 0x10062320
push eax
call edi
test eax, eax
je 0x1000a0fd
lea eax, [ebp - 0x218]
push 0x1006231c
push eax
call edi
test eax, eax
je 0x1000a0fd
and byte [ebp - 0x348], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x347]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x348]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x104]
push 0x10060430
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x348]
push eax
call fcn.10009fc0
add esp, 0x1c
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000a07c
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
jmp 0x1000a12f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1000a12f
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x1000a133
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x1000a2c8
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x1000a2c8
push edi
push edi
push edi
push edi
lea eax, [ebp - 4]
push edi
push eax
push esi
mov dword [ebp - 4], edi
call fcn.1000801b
add esp, 0x1c
test eax, eax
je 0x1000a2c8
cmp dword [ebp - 4], 0xffffffff
je 0x1000a2c8
test byte [ebp - 4], 1
je 0x1000a196
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 4], 0x10
je 0x1000a2bf
mov word [ebp - 0x210], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcscpy]
lea eax, [ebp - 0x210]
push esi
push eax
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [ebp - 0x210]
push 0x100622ec
push eax
call esi
and dword [ebp - 0x460], 0
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x45c]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x1000a2b3
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x434]
push 0x10061a40
push eax
call edi
test eax, eax
je 0x1000a292
lea eax, [ebp - 0x434]
push 0x10061a3c
push eax
call edi
test eax, eax
je 0x1000a292
and word [ebp - 0x668], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x666]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x668]
push eax
call ebx
lea eax, [ebp - 0x210]
push 0x10062324
push eax
call esi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x668]
push eax
call fcn.1000a133
add esp, 0x1c
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000a216
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop ebx
jmp 0x1000a2ca
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000a2ca
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1000a311
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push dword [ebp + 0xc]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000a3df
test bl, 1
je 0x1000a345
and ebx, 0xfffffffe
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x1000a3df
and byte [ebp - 0x204], 0
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push str._s.bak_08X
push eax
call ebx
and dword [ebp - 4], 0
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call esi
cmp eax, 0xffffffff
je 0x1000a3cf
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push eax
lea eax, [ebp - 0x204]
push dword [ebp + 0xc]
push str._s.bak_08X
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x1000a395
xor eax, eax
jmp 0x1000a3ee
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a5c6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
call fcn.1002ca70
test eax, eax
je 0x1000a5e3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop ebp
ret
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
je 0x1000a64d
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x1000a64d
lea eax, [esi + esi]
push eax
push ebx
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memset
push esi
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1000a64d
push esi
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test ebx, ebx
je 0x1000a64d
push esi
xor ebx, ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
call fcn.100076bd
add esp, 0x10
test eax, eax
je 0x1000a64d
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x1000b5ad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x1000b5c7
xor esi, esi
jmp 0x1000b5f5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10013b30
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x1000b630
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x1000b629
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000b6c5
xor esi, esi
jmp 0x1000b6c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x1000b653
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x1000b666
xor esi, esi
jmp 0x1000b6bc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x1000b678
jmp 0x1000b643
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000b6bc
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x1000b6ae
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.10013b30
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.1000b72c
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1000c13b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x100551c0
call fcn.10013ac0
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.1000c0fd
mov edi, eax
cmp edi, esi
je 0x1000c185
cmp dword [ebp - 0x10], esi
je 0x1000c17e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000c222
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x1000c1f6
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.1000c13b
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x1000c1e3
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x1000c1a8
cmp dword [ebp - 0x10], esi
je 0x1000c1f1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x1000c222
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1000c209
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x1000c220
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4