joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f3a1
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.10039d10
push 0xffffffffffffffff
push 0x10057e7b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
xor eax, eax
push 0xffe
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10039d40
call fcn.1002b477
push edx
push eax
push 0x100603ac
lea eax, [ebp]
push 0x800
push eax
call fcn.1002b477
add esp, 0x20
mov edi, 0x2001f
push edi
push 0x100603b8
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x20]
call fcn.1002b477
mov dword [ebp - 0x10], eax
cmp eax, 2
jne 0x1001f44c
push str._setSystemWebJavaEnabled:_OK_regkey_does_not_exists
call fcn.1002b477
pop ecx
jmp 0x1001f46e
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._setSystemWebJavaEnabled:_open_JavaDeploy_subkey
call fcn.10001309
push dword [ebp - 0x10]
call fcn.10029002
pop ecx
pop ecx
cmp eax, ebx
je 0x1001f54a
push 0x100604bc
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x10], eax
cmp eax, 2
jne 0x1001f487
mov dword [ebp - 0x10], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._setSystemWebJavaEnabled:_delete_WebDeployJava
call fcn.10001309
push dword [ebp - 0x10]
call fcn.10029002
pop ecx
pop ecx
cmp eax, ebx
je 0x1001f54a
push edi
lea eax, [ebp]
push eax
push 0x10060538
push 0x10060574
push esi
call fcn.1001f0f9
add esp, 0x14
push 0x100605b8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.10001309
mov eax, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], esp
mov dword [ecx], eax
cmp eax, ebx
je 0x1001f4ee
add eax, 8
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push dword [ebp - 0x10]
call fcn.10029002
push edi
push 0x100605ac
push 0x10060610
push 0x10060648
push esi
call fcn.1001f0f9
add esp, 0x1c
push str.___Create_HKLM_webjavaswitch_status_enabled
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.100014b2
mov esi, dword [ebp - 0x14]
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
mov dword [eax], esi
cmp esi, ebx
je 0x1001f537
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push edi
call fcn.10029002
pop ecx
pop ecx
cmp esi, ebx
je 0x1001f54a
mov ecx, esi
call fcn.10001441
lea ecx, [ebp - 0x20]
call fcn.10016b3c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x1004
leave
ret
Function at 0x1001f6f2
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x10057eeb
call fcn.10039bd1
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
call fcn.1002cfd0
test eax, eax
je 0x1001f73d
call fcn.1002b477
test eax, eax
je 0x1001f72f
call fcn.1002b477
test eax, eax
je 0x1001f72f
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
jmp 0x1001f749
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x1001f749
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push str.__get_system_dir__
lea ecx, [ebp + 8]
mov edi, eax
call fcn.1001060c
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f785
call fcn.10001441
push 0x10060c00
lea ecx, [ebp - 0x10]
call fcn.1001060c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f7b2
call fcn.10001441
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], esi
test esi, esi
je 0x1001f7cb
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
test edi, edi
setne al
movzx eax, al
push eax
call fcn.1002914a
pop ecx
pop ecx
test esi, esi
je 0x1001f7e6
mov ecx, esi
call fcn.10001441
mov eax, edi
call fcn.10039c70
ret
Function at 0x100226a4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x1005856a
call fcn.10039bd1
lea eax, [ebp - 0x1c]
push eax
call fcn.1002b477
pop ecx
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x100226d3
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push 0x10064c94
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10022704
call fcn.10001441
push 0x10064924
lea ecx, [ebp - 0x10]
call fcn.10001309
push 0x100649a4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x10022742
call fcn.10001441
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001524
push 0x10064a6c
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x1002277b
call fcn.10001441
push 0x10064d30
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001524
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x100227a4
call fcn.10001441
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10039d40
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x70], 0x44
stosd dword es:[edi], eax
cmp esi, ebx
je 0x100227cd
mov edx, dword [esi]
jmp 0x100227cf
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x100227da
mov ecx, dword [eax]
jmp 0x100227dc
xor ecx, ecx
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x100227e7
mov eax, dword [edi]
jmp 0x100227e9
xor eax, eax
lea esi, [ebp - 0x2c]
push esi
lea esi, [ebp - 0x70]
push esi
push edx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x1002283c
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1002282c
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.1001bbe6
push dword [ebp - 0x28]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x10022848
call fcn.10001441
cmp edi, ebx
je 0x10022853
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x1002285f
call fcn.10001441
call fcn.10039c70
ret
Function at 0x10022865
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x100585bd
call fcn.10039bd1
lea eax, [ebp - 0x1c]
push eax
call fcn.1002b477
pop ecx
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x10022894
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push 0x10064d14
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x100228c5
call fcn.10001441
push 0x10064afc
lea ecx, [ebp - 0x10]
call fcn.10001309
push 0x10064cac
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x10022903
call fcn.10001441
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001524
push 0x10064d2c
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x1002293c
call fcn.10001441
push str.__wait__fix__shortcut__silent
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001524
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x10022965
call fcn.10001441
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10039d40
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x70], 0x44
stosd dword es:[edi], eax
cmp esi, ebx
je 0x1002298e
mov edx, dword [esi]
jmp 0x10022990
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x1002299b
mov ecx, dword [eax]
jmp 0x1002299d
xor ecx, ecx
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x100229a8
mov eax, dword [edi]
jmp 0x100229aa
xor eax, eax
lea esi, [ebp - 0x2c]
push esi
lea esi, [ebp - 0x70]
push esi
push edx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x100229fd
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100229ed
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.1001bbe6
push dword [ebp - 0x28]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x10022a09
call fcn.10001441
cmp edi, ebx
je 0x10022a14
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x10022a20
call fcn.10001441
call fcn.10039c70
ret
Function at 0x10022a26
Capabilities:
Delete registry value

Disassembly:
push 0x10
mov eax, 0x100585e0
call fcn.10039bd1
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push 0x2001f
push str.SOFTWAREOracleJavaFX
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
inc ebx
call fcn.1002b477
test eax, eax
je 0x10022a70
lea ecx, [ebp - 0x1c]
mov esi, ebx
call fcn.10016b3c
mov eax, esi
call fcn.10039c70
ret
push str.Disabled
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
cmp edi, esi
je 0x10022aa3
cmp edi, 2
je 0x10022aa3
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.cleanupJavaFXDisabledEntry_error
call fcn.10001309
push edi
call fcn.10029002
pop ecx
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.10016b3c
jmp 0x10022a5e
Function at 0x1002461e
Capabilities:
Delete registry value

Disassembly:
push 0x28
mov eax, 0x1005890c
call fcn.10039bd1
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov ebx, 0x20019
push ebx
push 0x10067aac
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1002b477
test eax, eax
jne 0x10024722
push ebx
push 0x10067b60
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.1002b477
test eax, eax
jne 0x10024712
lea eax, [ebp - 0x1c]
push 0x10067b74
push eax
call fcn.1001bd54
pop ecx
pop ecx
test eax, eax
je 0x100246f3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
push 0x20006
push 0x10067b90
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.1002b477
test eax, eax
je 0x100246c3
push str.DeleteEmptyDeploymentKeysInHLKM:_failed_to_open_JRE_key
call fcn.1002b477
jmp 0x100246ea
push str.BrowserJavaVersion
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.DeleteEmptyDeploymentKeysInHLKM:_Remove_BrowserJavaVersion_value
mov esi, eax
call fcn.10001309
push esi
call fcn.10029002
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.10016b3c
lea eax, [ebp - 0x1c]
push str.Java_Web_Start
push eax
call fcn.1001bd54
lea eax, [ebp - 0x1c]
push str.Java_Web_Start_Caps
push eax
call fcn.1001bd54
add esp, 0x10
lea eax, [ebp - 0x28]
push 0x10067d4c
push eax
call fcn.1001bd54
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.10016b3c
lea ecx, [ebp - 0x28]
call fcn.10016b3c
call fcn.10039c70
ret
Function at 0x10024e7b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x798]
sub esp, 0x818
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x794], eax
mov eax, dword [ebp + 0x7a0]
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10068b78
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10024f91
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x78], esi
push esi
jmp 0x10024f73
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x70], esi
jbe 0x10024f61
cmp word [ebp + eax*2 - 0x6c], 0x2e
jne 0x10024ef7
inc ecx
cmp ecx, 1
jg 0x10024f02
inc eax
cmp eax, dword [ebp - 0x70]
jb 0x10024ee9
cmp ecx, 1
jle 0x10024f61
push 0x10068af4
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
js 0x10024f61
lea eax, [ebp - 0x6c]
push eax
call fcn.1002d6af
pop ecx
test eax, eax
je 0x10024f61
mov eax, dword [ebp - 0x70]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002b477
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0x70]
push 0x10068bd0
inc ecx
push ecx
push eax
mov dword [ebp - 0x80], eax
call fcn.1002b477
mov ecx, dword [ebp - 0x7c]
add esp, 0x14
lea eax, [ebp - 0x80]
push eax
call fcn.10028f9f
inc dword [ebp - 0x78]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
push dword [ebp - 0x74]
mov dword [ebp - 0x70], 0x400
call edi
test eax, eax
je 0x10024ee0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x794]
xor ecx, ebp
pop esi
call fcn.10039bc2
add ebp, 0x798
leave
ret
Function at 0x100253d2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.10039d10
push 0xffffffffffffffff
push 0x10058a88
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x100c]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x2c], esi
push 0xffe
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], ebx
call fcn.10039d40
add esp, 0xc
push 0x100600ea
mov ecx, ebx
call fcn.1001060c
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
push str.GetLatestJavawsVersion__:
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x800
call fcn.1002b477
pop ecx
cmp dword [ebp + 0x1010], esi
je 0x1002547f
mov edi, 0x20219
push str.___checking_32_bit
jmp 0x10025489
mov edi, 0x20119
push str.___checking_64_bit
call fcn.1002b477
pop ecx
push edi
push 0x10061dd8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x28]
call fcn.1002b477
cmp eax, esi
je 0x100254e6
push str.___failed_to_open_SOFTWAREJavaSoftJava_Web_Start
call fcn.1002b477
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10016b3c
lea ecx, [ebp - 0x28]
call fcn.10016b3c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x1004
leave
ret
lea eax, [ebp - 0x38]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100254b1
push str.___Processing_key:
lea ecx, [ebp - 0x10]
call fcn.1001060c
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001309
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.10001524
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp ecx, esi
je 0x10025545
call fcn.10001441
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x10]
cmp edi, esi
je 0x10025550
mov eax, dword [edi]
jmp 0x10025552
xor eax, eax
push eax
call fcn.1002b477
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.10021c41
add esp, 0xc
test eax, eax
jne 0x100255a2
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.1002192e
pop ecx
pop ecx
test eax, eax
jne 0x100255a2
push 0x10061ea0
call fcn.1002b477
lea eax, [ebp]
push eax
call fcn.1002b477
pop ecx
xor eax, eax
pop ecx
mov word [ebp], ax
jmp 0x100255c9
mov eax, dword [ebx]
cmp eax, esi
je 0x100255ac
mov eax, dword [eax]
jmp 0x100255ae
xor eax, eax
push eax
lea eax, [ebp]
push eax
call fcn.1002b477
pop ecx
pop ecx
test eax, eax
jle 0x100255c9
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.100014b2
inc dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x800
mov byte [ebp - 4], 1
cmp edi, esi
je 0x100254e6
mov ecx, edi
call fcn.10001441
mov dword [ebp - 0x10], esi
jmp 0x100254e6
Function at 0x10029531
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, dword [ebp + 0x1bc]
push esi
mov esi, dword [ebp + 0x1c0]
push 0x10069148
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.1002b477
add esp, 0xc
test eax, eax
jne 0x1002969a
push esi
call fcn.1002b477
pop ecx
test eax, eax
jne 0x1002969a
push edi
xor edi, edi
inc edi
jmp 0x1002966d
cmp dword [ebp - 0x78], 0x4034b50
jne 0x10029690
cmp word [ebp - 0x70], 0
jne 0x10029690
push dword [ebp - 0x7c]
movzx eax, word [ebp - 0x5e]
movzx esi, word [ebp - 0x5e]
push eax
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.1002b477
add esp, 0x10
cmp eax, esi
jne 0x10029690
xor eax, eax
mov word [ebp + esi*2 - 0x58], ax
lea eax, [ebp - 0x58]
push eax
call fcn.1002b477
cmp word [ebp - 0x5c], 0
pop ecx
jbe 0x100295f5
movzx eax, word [ebp - 0x5c]
push edi
push eax
push dword [ebp - 0x7c]
call fcn.1003e696
add esp, 0xc
test eax, eax
jne 0x10029690
movzx eax, word [ebp - 0x5e]
cmp word [ebp + eax*2 - 0x5a], 0x2f
je 0x1002966d
push 0x10069150
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.1002b477
add esp, 0xc
test eax, eax
jne 0x10029690
mov eax, dword [ebp - 0x62]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002b477
push dword [ebp - 0x7c]
mov esi, eax
push dword [ebp - 0x62]
push edi
push esi
call fcn.1002b477
add esp, 0x14
cmp eax, dword [ebp - 0x62]
jne 0x10029689
push dword [ebp - 0x80]
push dword [ebp - 0x62]
push edi
push esi
call fcn.1003c319
add esp, 0x10
push esi
cmp eax, dword [ebp - 0x62]
jne 0x1002968a
call fcn.1002b477
push dword [ebp - 0x80]
call fcn.1003c14e
pop ecx
pop ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push edi
push 0x1e
push eax
call fcn.1002b477
add esp, 0x10
cmp eax, edi
je 0x1002958b
jmp 0x10029690
push esi
call fcn.1002b477
pop ecx
push dword [ebp - 0x7c]
call fcn.1003c14e
pop ecx
pop edi
mov ecx, dword [ebp + 0x1b0]
xor ecx, ebp
pop esi
call fcn.10039bc2
add ebp, 0x1b4
leave
ret
Function at 0x100296b0
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x21e0]
mov eax, 0x2260
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x21dc], eax
mov eax, dword [ebp + 0x21e8]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
xor eax, eax
mov esi, 0xffe
xor edi, edi
push esi
mov word [ebp + 0x11dc], ax
lea eax, [ebp + 0x11de]
push edi
push eax
mov dword [ebp - 0x78], edi
call fcn.10039d40
xor eax, eax
push esi
mov word [ebp + 0x1dc], ax
lea eax, [ebp + 0x1de]
push edi
push eax
call fcn.10039d40
mov esi, 0x800
push str.SOFTWAREMozillaMozilla_Firefox
lea eax, [ebp + 0x11dc]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.1002b477
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 0x24
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x11dc]
push eax
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call edi
test eax, eax
je 0x10029754
xor eax, eax
jmp 0x1002984e
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1dc]
push eax
push 0
push 0
push 0x1006919c
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x10029780
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002974d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1dc]
push eax
lea eax, [ebp + 0x11dc]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x11dc]
push eax
push ebx
call edi
test eax, eax
jne 0x1002974d
mov ebx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0
push 0
push 0x100691bc
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
jne 0x10029778
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100297e3
sub eax, edx
sar eax, 1
cmp word [ebx + eax*2 - 2], 0x5c
je 0x1002980f
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100297fd
mov esi, 0x10069234
movsd dword es:[edi], dword [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10029812
push 5
pop ecx
mov esi, 0x10069238
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x74]
push eax
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x10029866
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x1002974d
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x21dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039bc2
add ebp, 0x21e0
leave
ret
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [ebp - 0x74], 0x10
jmp 0x10029845