joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4183dc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x158]
mov edx, dword [0x406f54]
call fcn.00405358
xor eax, eax
push ebp
push 0x4185ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x15c]
mov ecx, 0x418604
call fcn.00404cf4
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
mov edx, 0x10
call fcn.0040841c
mov ebx, eax
test ebx, ebx
jne 0x418571
xor eax, eax
push ebp
push 0x41856a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x418551
mov eax, dword [ebp - 0x14c]
mov edx, 0x418610
call fcn.00404df4
je 0x41853c
mov eax, dword [ebp - 0x14c]
mov edx, 0x41861c
call fcn.00404df4
je 0x41853c
test byte [ebp - 0x150], 0x10
je 0x41853c
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x14c]
call fcn.00404cf4
mov eax, dword [ebp - 0x160]
xor edx, edx
call fcn.00408388
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404ca8
inc eax
push eax
lea eax, [ebp - 0x164]
mov ecx, 0x418628
mov edx, dword [ebp - 0x14c]
call fcn.00404cf4
mov eax, dword [ebp - 0x164]
mov edx, dword [ebp + 8]
add edx, 0xfffffffc
pop ecx
call fcn.00404f90
mov eax, dword [ebp + 8]
push eax
call fcn.004183dc
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404ca8
mov ebx, eax
mov eax, dword [ebp - 0x14c]
call fcn.00404ca8
sub ebx, eax
inc ebx
push ebx
mov eax, dword [ebp - 0x14c]
call fcn.00404ca8
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
pop edx
call fcn.00404f48
lea eax, [ebp - 0x158]
call fcn.0040846c
mov ebx, eax
test ebx, ebx
je 0x41846b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418571
lea eax, [ebp - 0x158]
call fcn.00408490
ret
lea edx, [ebp - 0x168]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040c238
mov edx, dword [ebp - 0x168]
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.00404aa4
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404ea8
push eax
call sub.kernel32.dll_MoveFileExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4185f4
lea eax, [ebp - 0x168]
call fcn.00404a0c
lea eax, [ebp - 0x164]
call fcn.00404a0c
lea eax, [ebp - 0x160]
mov edx, 2
call fcn.00404a30
lea eax, [ebp - 0x158]
mov edx, dword [0x406f54]
call fcn.0040541c
ret
Function at 0x4186a4
Capabilities:
Create process on windows
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41887c
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x418766
lea edx, [ebp - 4]
mov eax, edi
call fcn.0040adf8
mov edx, dword [ebp - 4]
mov eax, 0x418894
call fcn.00404fec
test eax, eax
jne 0x418702
push ebx
push 0x4188a0
push 0x4188a0
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404d68
jmp 0x418726
mov al, byte [0x4188a4]
push eax
lea eax, [ebp - 8]
push eax
mov edx, 0x418894
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0040c9d8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404aa4
push 0x10
push 0
mov eax, dword [ebp - 4]
call fcn.00404ea8
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x81cc10]
push eax
call sub.user32.dll_DestroyWindow
mov eax, dword [0x81cc14]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x81cc18]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x41a964]
mov dword [eax], 0xffffffff
mov eax, dword [0x81cc04]
call fcn.004057bc
mov esi, eax
test esi, esi
jl 0x4187a3
inc esi
xor ebx, ebx
mov eax, dword [0x81cc04]
mov eax, dword [eax + ebx*4]
xor edx, edx
call fcn.00408388
push 4
push 0
mov eax, dword [0x81cc04]
mov eax, dword [eax + ebx*4]
call fcn.00404ea8
push eax
call sub.kernel32.dll_MoveFileExA
inc ebx
dec esi
jne 0x418779
cmp dword [0x41a940], 0
je 0x4187b6
mov eax, dword [0x41a940]
call fcn.0041862c
test edi, edi
jne 0x41885c
mov eax, dword [0x41ab18]
cmp byte [eax + 0xc], 0
je 0x41885c
mov eax, 0x81cc1c
xor ecx, ecx
mov edx, 0x3c
call fcn.00403424
mov dword [0x81cc1c], 0x3c
mov dword [0x81cc20], 0x440
lea eax, [ebp - 0xc]
mov ecx, 0x4188b0
mov edx, dword [0x41a940]
call fcn.00404cf4
mov eax, dword [ebp - 0xc]
call fcn.00404ea8
mov dword [0x81cc2c], eax
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402dec
mov eax, dword [ebp - 0x10]
call fcn.00404ea8
mov dword [0x81cc30], eax
xor eax, eax
mov dword [0x81cc34], eax
mov dword [0x81cc38], 1
mov eax, dword [0x41a964]
xor edx, edx
mov dword [eax], edx
push 0x81cc1c
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x41885c
mov eax, dword [0x81cc54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00404914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418883
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a30
ret
Function at 0x10001260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000d338
push 0x1000bd70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
cmp dword [0x10010368], esi
jne 0x10001367
xor edi, edi
cmp dword [0x10010360], esi
je 0x100012ac
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x10010368], esi
jne 0x1000133b
cmp dword [0x10010360], esi
jne 0x100012c9
call fcn.10001470
test eax, eax
je 0x10001340
mov ebx, dword [0x1000f0dc]
mov eax, dword [0x10013f58]
cmp eax, esi
jne 0x10001330
mov eax, dword [0x10013f5c]
cmp eax, esi
jne 0x10001315
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x1000130a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000130a
push 0x1000f104
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov eax, esi
mov dword [0x10013f5c], eax
test esi, esi
je 0x10001321
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10013f58], eax
xor esi, esi
cmp eax, esi
jne 0x10001330
xor eax, eax
jmp 0x10001337
lea ecx, [ebp - 0x24]
push ecx
push ebx
call eax
cmp eax, esi
je 0x10001340
mov edi, 1
cmp edi, esi
jne 0x10001367
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x10001354
cmp eax, 0x78
jne 0x1000135f
mov edi, 1
mov dword [0x10010368], edi
cmp edi, esi
jne 0x10001367
xor eax, eax
jmp 0x1000136c
mov eax, 1
cmp eax, esi
jne 0x10001385
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 4], esi
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100013c7
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10001f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10001fea
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x10001fdf
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
ret

Function at 0x10001ff0
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x104
push esi
xor esi, esi
test eax, eax
jle 0x10002068
push ebx
mov ebx, dword [esp + 0x118]
push ebp
mov ebp, dword [esp + 0x118]
push edi
mov al, byte [0x1001036c]
mov ecx, 0x40
mov byte [esp + 0x10], al
xor eax, eax
lea edi, [esp + 0x11]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push str._s_d
lea ecx, [esp + 0x1c]
push 0x103
push ecx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esp + 0x12c]
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push ebp
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov eax, dword [esp + 0x124]
inc esi
cmp esi, eax
jl 0x10002012
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x104
ret

Function at 0x10002070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x244
push esi
push edi
mov ecx, 0x50
xor eax, eax
lea edi, [esp + 8]
mov edx, dword [esp + 0x250]
rep stosd dword es:[edi], eax
mov al, byte [0x1001036c]
mov ecx, 0x40
mov byte [esp + 0x148], al
xor eax, eax
lea edi, [esp + 0x149]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x254]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
push str._s_s
lea eax, [esp + 0x154]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea ecx, [esp + 8]
lea edx, [esp + 0x148]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100020f4
pop edi
or eax, eax
pop esi
add esp, 0x244
ret
mov eax, dword [esp + 8]
mov ecx, eax
or ecx, 0x10
cmp eax, ecx
jne 0x10002141
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 8]
push edx
push esi
call edi
test eax, eax
je 0x1000212c
mov eax, dword [esp + 8]
mov ecx, eax
or ecx, 0x10
cmp eax, ecx
jne 0x10002141
lea edx, [esp + 8]
push edx
push esi
call edi
test eax, eax
jne 0x10002113
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, 1
pop esi
add esp, 0x244
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop esi
add esp, 0x244
ret
Function at 0x100025b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 8], ebp
je 0x100026db
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x24]
push eax
push 0x40000
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x100026ca
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
push ecx
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x100026ca
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100026c5
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0x20019
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x100026ca
push eax
push eax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push ebp
lea eax, [esp + 0x40]
push edx
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x100026ca
push 0x105
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 4
xor edi, edi
test eax, eax
jbe 0x100026bc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edx, dword [esp + 0x10]
push 0x105
push esi
push edi
push edx
call ebx
test eax, eax
jne 0x100026ac
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push 1
push eax
push esi
push ecx
call fcn.100025b0
add esp, 0x10
jmp 0x100026b3
cmp eax, 0x103
je 0x100026bc
mov eax, dword [esp + 0x28]
inc edi
cmp edi, eax
jb 0x10002683
push esi
call fcn.1000bd60
add esp, 4
mov ebp, 1
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x100026db
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x100026f0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x674
push ebx
push ebp
push esi
mov esi, dword [esp + 0x688]
test esi, esi
push edi
je 0x1000291a
cmp byte [esi], 0
je 0x1000291a
mov eax, dword [esp + 0x688]
mov ebx, dword [sym.imp.MSVCRT.dll__snprintf]
push eax
push esi
push str._s_s
lea ecx, [esp + 0x488]
push 0x103
push ecx
mov dword [esp + 0x44], 0x80
call ebx
add esp, 0x14
lea edx, [esp + 0x30]
lea eax, [esp + 0x47c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [0x10013ec8]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
jne 0x10002902
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp dword [esp + 0x10], 0xffffffff
je 0x1000291a
push 1
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x100027a8
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
lea eax, [esp + 0x5c]
push 0x1000f1f0
push eax
call edi
add esp, 8
test eax, eax
je 0x100028db
lea ecx, [esp + 0x5c]
push 0x1000f1ec
push ecx
call edi
add esp, 8
test eax, eax
je 0x100028db
test byte [esp + 0x30], 0x10
jne 0x10002861
mov dl, byte [0x1001036c]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x275]
mov byte [esp + 0x274], dl
mov byte [esp + 0x170], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x171]
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push esi
stosb byte es:[edi], al
push str._s_s
lea eax, [esp + 0x280]
push 0x103
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x170]
lea edx, [esp + 0x274]
push 0x104
push ecx
push edx
call ebp
lea eax, [esp + 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100028db
mov eax, dword [esp + 0x690]
test eax, eax
je 0x100028db
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x378]
lea edx, [esp + 0x378]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x5c]
push ecx
push esi
push str._s_s
push 0x103
push edx
call ebx
mov eax, dword [esp + 0x6a4]
mov edx, dword [esp + 0x69c]
lea ecx, [esp + 0x38c]
push eax
push ecx
push edx
call fcn.100026f0
add esp, 0x20
lea eax, [esp + 0x580]
lea ecx, [esp + 0x378]
push 0x104
push eax
push ecx
call ebp
lea edx, [esp + 0x580]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10002902
mov ecx, dword [0x10013ec8]
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
je 0x10002770
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x674
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x674
ret
Function at 0x10002930
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x658
push ebx
push ebp
push esi
mov esi, dword [esp + 0x668]
mov ebx, dword [sym.imp.MSVCRT.dll__snprintf]
push edi
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push eax
push ecx
push str._s_s
lea edx, [esp + 0x46c]
push 0x103
push edx
mov dword [esp + 0x28], 0x80
call ebx
add esp, 0x14
lea eax, [esp + 0x14]
lea ecx, [esp + 0x460]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [0x10013ec8]
mov edi, eax
mov dword [esp + 0x10], edi
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
jne 0x10002b01
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp edi, 0xffffffff
je 0x10002b01
lea eax, [esp + 0x40]
push 0x1000f1f0
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x10002ade
lea ecx, [esp + 0x40]
push 0x1000f1ec
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x10002ade
test byte [esp + 0x14], 0x10
jne 0x10002a6a
mov dl, byte [0x1001036c]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35d]
mov byte [esp + 0x35c], dl
mov byte [esp + 0x258], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x259]
lea edx, [esp + 0x40]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 4]
push edx
push eax
push str._s_s
lea ecx, [esp + 0x368]
push 0x103
push ecx
call ebx
add esp, 0x14
lea edx, [esp + 0x258]
lea eax, [esp + 0x35c]
push 0x104
push edx
push eax
call ebp
lea ecx, [esp + 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10002ada
mov eax, dword [esi + 8]
test eax, eax
je 0x10002ade
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x154]
lea edx, [esp + 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 4]
push edx
push eax
push str._s_s
lea ecx, [esp + 0x160]
push 0x103
push ecx
call ebx
mov edx, dword [esi + 8]
mov ecx, dword [esi]
lea eax, [esp + 0x168]
push edx
push eax
push ecx
call fcn.100026f0
add esp, 0x20
lea edx, [esp + 0x564]
lea eax, [esp + 0x154]
push 0x104
push edx
push eax
call ebp
lea ecx, [esp + 0x564]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10002b01
mov ecx, dword [0x10013ec8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
je 0x1000299f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x658
ret
Function at 0x10002ca0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [str.opennew]
mov ecx, dword [0x1000f3c4]
mov dl, byte [0x1001036c]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1c]
mov byte [esp + 0x118], dl
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x1001036c
mov ebx, 0x104
push str.http_shell
push 0x80000000
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], ebx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
jne 0x10002d3c
push 0x1001036c
push str.http_shell
push 0x80000000
call edi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x1001036c
push str.ftp_shell
push 0x80000000
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jne 0x10002d80
push 0x1001036c
push str.ftp_shell
push 0x80000000
call edi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x1001036c
push str.https_shell
push 0x80000000
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jne 0x10002dc4
push 0x1001036c
push str.https_shell
push 0x80000000
call edi
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x14]
push ecx
push eax
push 1
push 0x1001036c
push str.htmlfile_shell
push 0x80000000
call ebx
mov edi, str._SystemRoot__system32url.dll_0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0xc], 2
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push 2
push 0x1001036c
push str.httpDefaultIcon
push 0x80000000
call ebx
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 2
push 0x1001036c
push str.httpsDefaultIcon
push 0x80000000
call ebx
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x14]
push ecx
push eax
push 2
push 0x1001036c
push str.ftpDefaultIcon
push 0x80000000
call ebx
pop edi
pop esi
pop ebx
add esp, 0x210
ret
Function at 0x10003210
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov dl, byte [0x1001036c]
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x1001036c
push str.CLSIDB83FC273_3522_4CC6_92EC_75CC86678DA4InprocServer32
push 0x80000000
xor ebx, ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x100033a4
lea eax, [esp + 0x14]
push 0x104
lea ecx, [esp + 0x11c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x14]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x100033a4
mov byte [eax], bl
mov edi, str.CnsMinIO.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
lea edx, [esp + 0x18]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x10013acc]
mov ecx, ebp
and ecx, 3
pop ebp
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x10003324
push 0x1000f404
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [0x10013acc], eax
jne 0x10003324
lea eax, [esp + 0x14]
push eax
call fcn.100033b0
test eax, eax
mov dword [0x10013acc], eax
je 0x100033a4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Init
push eax
call esi
mov ecx, dword [0x10013acc]
push str.GetCount
push ecx
mov dword [0x10013ad4], eax
call esi
mov edx, dword [0x10013acc]
push str.GetName
push edx
mov dword [0x10013adc], eax
call esi
mov dword [0x10013ae0], eax
mov eax, dword [0x10013acc]
push str.Free
push eax
call esi
mov ecx, dword [0x10013acc]
push str.DeleteName
push ecx
mov dword [0x10013ad8], eax
call esi
mov edx, dword [0x10013acc]
push str.Save
push edx
mov dword [0x10013ad0], eax
call esi
pop edi
mov dword [0x10013ae4], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x210
ret