joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cfc5e9c
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov eax, dword [esi + 8]
test byte [esi + 0x28], 1
mov dword [ebp - 4], eax
jne 0x7cfc603c
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x7cfc5ed5
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, 0x102
lea eax, [ebp - 0x294]
push edi
push eax
push 0x300a
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [ebp - 0x49c]
push edi
push eax
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x49c]
push eax
push edi
call fcn.7cfc5e2a
test eax, eax
je 0x7cfc5fef
lea eax, [ebp - 0x8c]
push 0x40
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x7cfc5f64
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x7cfc5f67
mov dword [ebp - 0xc], edi
push dword [esi + 0x10]
lea eax, [ebp - 0x49c]
push eax
push dword [ebp - 0xc]
push edi
call fcn.7cfc6784
sub eax, ebx
je 0x7cfc5f92
dec eax
je 0x7cfc5f89
dec eax
jne 0x7cfc5fef
mov dword [ebp - 8], ebx
jmp 0x7cfc5fef
mov dword [ebp - 8], 1
jmp 0x7cfc5fef
mov eax, dword [esi + 0x1c]
movzx edi, al
shr edi, 2
and edi, 1
test al, 0x20
jne 0x7cfc5fbc
test al, 0x10
je 0x7cfc5fbc
push 0x3012
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x7cfc5fbc
or edi, 2
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea eax, [ebp - 0x8c]
push edi
push eax
push 1
push dword [esi + 0x10]
lea eax, [ebp - 0x49c]
push eax
push dword [ebp - 0xc]
call fcn.7cf879a3
mov edi, dword [ebp - 4]
mov dword [ebp - 8], eax
mov esi, dword [esi + 0x24]
cmp esi, ebx
je 0x7cfc6006
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [ebp - 8], ebx
je 0x7cfc6041
call fcn.7cfc5a51
mov esi, eax
cmp esi, ebx
je 0x7cfc603c
lea eax, [ebp - 0x294]
push 0x7cf3e66c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x294]
push eax
push esi
call dword [sym.imp.COMCTL32.dll_AddMRUStringW]
push esi
call fcn.7cfc5a9a
push 1
pop eax
jmp 0x7cfc606b
push 0x47
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x300a
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7cfc6a02
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
call fcn.7cf5802a
lea eax, [ebp - 4]
push eax
push 0x7cf4c3f0
push edi
call fcn.7cfc5abf
mov esi, dword [ebp - 4]
cmp esi, edi
je 0x7cfc6ac4
mov eax, dword [ebp + 0xc]
push 0x40000024
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x1c], eax
call sym.SHELL32.dll_SHRestricted
test eax, eax
je 0x7cfc6a5c
and dword [esi + 0x1c], 0xffffffdf
jmp 0x7cfc6a60
or dword [esi + 0x1c], 0x20
cmp dword [ebp + 8], edi
je 0x7cfc6a9f
push 0x7cf3e5e0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropW]
cmp eax, edi
mov dword [esi + 0x24], eax
je 0x7cfc6a9f
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0x7cf3e5b8
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [esi + 0x20], eax
push esi
push 0x7cfc6819
push dword [ebp + 8]
push 0x3eb
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.7cf52009
mov eax, edi
pop edi
pop esi
leave
ret 0x18
Function at 0x7cfc6ed4
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
call fcn.7cfc6d4b
mov eax, dword [esp + 0x20]
cmp eax, ebx
jne 0x7cfc6f30
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
cmp esi, ebx
jle 0x7cfc7052
lea eax, [esi + esi + 2]
push eax
call fcn.7d042358
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x7cfc7052
push esi
push eax
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x7cfc6f34
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
je 0x7cfc7052
mov eax, dword [esp + 0x10]
cmp word [eax], bx
je 0x7cfc7052
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp word [edi], 0
je 0x7cfc7052
push 0x7cf3e7d8
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x7cfc6fa3
push 0x7cf3e7d0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x7cfc6fa3
push edi
call ebp
lea esi, [edi + eax*2]
push 0xffffffffffffffff
push esi
push edi
call fcn.7cfc6d82
test eax, eax
je 0x7cfc6f9c
mov ecx, dword [esp + 0x14]
push eax
call fcn.7cfc7074
mov edi, esi
jmp 0x7cfc704a
cmp esi, edi
jbe 0x7cfc6fbe
push 0xffffffffffffffff
push esi
push edi
call fcn.7cfc6d82
test eax, eax
je 0x7cfc6fbe
mov ecx, dword [esp + 0x14]
push eax
call fcn.7cfc7074
xor eax, eax
test esi, esi
je 0x7cfc6fd2
cmp word [esi], 0
je 0x7cfc6fd2
inc eax
inc esi
inc esi
cmp eax, 3
jl 0x7cfc6fc0
test esi, esi
mov edi, esi
je 0x7cfc704a
cmp word [esi], 0
je 0x7cfc704a
push 0x7cf3e7c4
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x7cfc7019
push 0x7cf3e7b8
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x7cfc7019
push esi
call ebp
lea edi, [esi + eax*2]
push 0xffffffffffffffff
push edi
push esi
call fcn.7cfc6d82
test eax, eax
je 0x7cfc704a
mov ecx, dword [esp + 0x14]
push eax
call fcn.7cfc7074
jmp 0x7cfc704a
push dword [esp + 0x18]
push edi
push esi
call fcn.7cfc6d82
test eax, eax
je 0x7cfc7036
mov ecx, dword [esp + 0x14]
push eax
call fcn.7cfc7074
inc dword [esp + 0x18]
xor eax, eax
test edi, edi
je 0x7cfc7052
cmp word [edi], 0
je 0x7cfc704a
inc eax
inc edi
inc edi
cmp eax, 4
jl 0x7cfc7038
test edi, edi
jne 0x7cfc6f59
cmp dword [esp + 0x20], 0
jne 0x7cfc706a
cmp dword [esp + 0x10], 0
je 0x7cfc706a
push dword [esp + 0x10]
call fcn.7cf5aedf
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x7cfca0a5
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x88]
lea edi, [esi + 0x88]
test eax, eax
je 0x7cfca19f
cmp word [eax], 0
je 0x7cfca19f
push 0x25
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
jne 0x7cfca19f
mov eax, dword [esi + 0x78]
test eax, eax
je 0x7cfca19f
lea ecx, [ebp - 0x208]
push ecx
push eax
call sym.SHELL32.dll_SHGetPathFromIDListW
test eax, eax
je 0x7cfca19f
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call sym.SHELL32.dll_SHGetPathFromIDListW
test eax, eax
je 0x7cfca19f
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7cfca19f
push 0x10
lea eax, [ebp - 0x208]
push dword [edi]
push dword [esi + 0xb8]
push eax
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
test eax, eax
je 0x7cfca19f
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.7cfca062
lea eax, [ebp - 0x208]
push eax
call sym.SHELL32.dll_Ordinal_159
test eax, eax
je 0x7cfca19f
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.COMCTL32.dll_Str_SetPtrW]
mov dword [esi + 0x44], 1
pop edi
pop esi
leave
ret 4
Function at 0x7cfcaf94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
lea eax, [ebp - 0x42c]
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
push 0x7cf3ec6c
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea eax, [ebp - 0xc]
mov edi, 0x20019
push eax
push edi
lea eax, [ebp - 0x42c]
push ebx
push eax
push reloc.SHLWAPI.dll_ParseURLW
call esi
test eax, eax
jne 0x7cfcb000
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x7cf3ec48
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x7cfcb00a
mov edi, 0x80004005
jmp 0x7cfcb137
push 4
lea eax, [ebp - 4]
pop ebx
mov esi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x7cf3ec34
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call esi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x7cfcb042
cmp dword [ebp - 0x14], 0
jne 0x7cfcb042
mov dword [edi + 4], 2
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x7cf3ec10
push dword [ebp - 8]
call esi
test eax, eax
jne 0x7cfcb095
lea eax, [edi + 0x2c]
push eax
lea eax, [edi + 0x28]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.7cfcae9f
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [edi + 8]
push eax
push 0
push 0
push 0x7cf3ec00
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push dword [ebp - 8]
call esi
test eax, eax
jne 0x7cfcb130
lea eax, [edi + 0x24]
lea ecx, [edi + 0x20]
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0x224]
push ecx
push eax
mov dword [ebp + 0xc], ecx
call fcn.7cfcae9f
test eax, eax
jl 0x7cfcb130
lea ecx, [ebp - 0x10]
lea eax, [edi + 0x18]
push ecx
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x7cf3ebe4
mov dword [ebp - 0x10], ebx
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x7cfcb130
lea eax, [ebp - 0x10]
add edi, 0x1c
push eax
lea eax, [ebp + 8]
push edi
push eax
push 0
push 0x7cf3ebc8
push dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x7cfcb130
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ecx]
cmp eax, ecx
ja 0x7cfcb135
jne 0x7cfcb130
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp eax, dword [edi]
ja 0x7cfcb135
push 1
pop edi
jmp 0x7cfcb137
xor edi, edi
cmp dword [ebp - 8], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x7cfcb148
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], 0
je 0x7cfcb153
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7cfcc934
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
cmp dword [ebp + 0x10], 0
je 0x7cfcc9a1
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7cfcc9a1
push 0
push 0
push esi
push esi
call sym.SHELL32.dll_PathYetAnotherMakeUniqueName
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7cfcc9a9
test al, 1
jne 0x7cfcc9a9
push 0
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.7cf9cee3
push 1
pop eax
pop esi
leave
ret 0xc
xor eax, eax
jmp 0x7cfcc9a4

Function at 0x7cfccc0a
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
push 0x7cf3e930
call fcn.7cfaf2ec
test eax, eax
je 0x7cfccc7d
xor edi, edi
push edi
push 0x7cf3ed9c
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
cmp ebx, edi
je 0x7cfccc7d
cmp word [ebp + 0xc], di
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x7cfccc4f
movzx eax, word [ebp + 0xc]
push edi
push eax
push 0x4ea
push ebx
call esi
cmp word [ebp + 0x10], di
je 0x7cfccc7d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov edi, eax
test di, di
je 0x7cfccc7d
movzx eax, di
push eax
movzx eax, word [ebp + 0x10]
push eax
push 0x4e9
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x7cfccc84
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 4], 0x80004005
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
cmp eax, ebx
je 0x7cfcccbd
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7cfcccbd
push 1
pop edi
mov dword [ebp - 8], edi
jmp 0x7cfcccc3
push 1
mov dword [ebp - 8], ebx
pop edi
test byte [esi + 0xb5], 0x10
je 0x7cfccce4
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 0xc], ebx
call fcn.7cfcc8c4
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x7cfcce00
mov ecx, dword [esi + 4]
lea eax, [esi + 4]
push ebx
push ebx
lea edx, [ebp - 0x218]
push 0x104
push edx
push eax
call dword [ecx + 0xc]
mov ebx, dword [esi + 0xb8]
not ebx
shr ebx, 4
and ebx, edi
je 0x7cfccd22
lea eax, [ebp - 0x218]
push eax
call fcn.7cf6af1b
cmp ax, 0x5a4d
jne 0x7cfccd22
mov dword [ebp - 0xc], edi
jmp 0x7cfccd26
and dword [ebp - 0xc], 0
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsAndAttributesW]
test ebx, ebx
mov edi, eax
je 0x7cfccda2
lea eax, [ebp - 0x218]
push eax
call fcn.7cfcc5ac
test eax, eax
jne 0x7cfccd57
lea eax, [ebp - 0x218]
push eax
call fcn.7cf9d3f2
test eax, eax
je 0x7cfccda2
push dword [ebp - 8]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
push dword [ebp + 8]
call fcn.7cfcc934
test eax, eax
je 0x7cfccdea
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x7cfcce00
push dword [ebp + 8]
call fcn.7cfcc5ac
test eax, eax
je 0x7cfccd9d
push ebx
push dword [ebp + 8]
jmp 0x7cfccdc1
mov dword [ebp - 4], ebx
jmp 0x7cfcce00
cmp dword [ebp - 0xc], 0
je 0x7cfccdca
push dword [ebp - 8]
push 0x7cf34b30
push dword [ebp + 8]
call fcn.7cfcc934
test eax, eax
je 0x7cfccdea
push 1
push dword [ebp + 8]
mov ecx, esi
call fcn.7cfcc9e0
jmp 0x7cfccdfd
push dword [ebp + 8]
call fcn.7cfcc5ac
test eax, eax
je 0x7cfccdf3
push dword [ebp - 8]
push 0x7cf34b24
push dword [ebp + 8]
call fcn.7cfcc934
test eax, eax
jne 0x7cfccdf3
mov dword [ebp - 4], 0x80004005
jmp 0x7cfcce00
push dword [ebp + 8]
mov ecx, esi
call fcn.7cfcc8c4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x7cfcce5a
mov ebx, dword [ebp + 8]
push 0
neg edi
sbb edi, edi
push ebx
and edi, 0x1ffe
push 5
inc edi
inc edi
push edi
call sym.SHELL32.dll_SHChangeNotify
push 0
push ebx
push 5
push 0x40000
call sym.SHELL32.dll_SHChangeNotify
mov ax, word [esi + 0x9c]
mov si, word [esi + 0xe0]
cmp ax, si
je 0x7cfcce4a
push esi
push eax
push ebx
call fcn.7cfccc0a
cmp dword [ebp + 0xc], 0
je 0x7cfcce5a
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.COMCTL32.dll_Str_SetPtrW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7cfcd330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ecx + 0x78]
push ebx
test eax, eax
push esi
je 0x7cfcd3dd
lea ecx, [ebp - 0x210]
push ecx
push eax
call sym.SHELL32.dll_SHGetPathFromIDListW
test eax, eax
je 0x7cfcd3dd
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
je 0x7cfcd3dd
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov ebx, eax
test ebx, ebx
je 0x7cfcd3dd
lea eax, [ebp - 8]
push eax
push 0
push ebx
push 0x7cfccf63
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x7cfcd3a4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7cfcd3dd
call fcn.7cfcd2bb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7cfcd3b8
push esi
jmp 0x7cfcd3ca
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0
push esi
jne 0x7cfcd3d7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x800705b4
jmp 0x7cfcd3df
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x7cfce911
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
push ebx
push esi
push 1
xor esi, esi
push 8
push esi
call sym.SHELL32.dll_SHCloneSpecialIDList
mov ebx, eax
cmp ebx, esi
je 0x7cfceaaf
lea eax, [ebp - 0x238]
push edi
mov dword [ebp - 0x28], eax
xor eax, eax
lea edi, [ebp - 0x1e]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x24], esi
mov word [ebp - 0x20], 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sym.SHELL32.dll_SHGetPathFromIDListW
lea eax, [ebp - 0x238]
push 0x7cf333a8
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x238]
push eax
call edi
mov word [ebp + eax*2 - 0x236], si
lea eax, [ebp - 0x30]
push eax
call sym.SHELL32.dll_SHFileOperationW
push ebx
call sym.SHELL32.dll_ILFree
push 1
pop ebx
push ebx
push 0x13
push esi
call sym.SHELL32.dll_SHCloneSpecialIDList
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x7cfcea75
push ebx
push esi
push 0x7cf37570
call fcn.7cf67d2c
cmp eax, esi
mov dword [ebp - 8], eax
je 0x7cfcea6d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 0x7cf398e0
push esi
call fcn.7cf5e90c
test eax, eax
jl 0x7cfcea64
lea eax, [ebp - 4]
push eax
push esi
push esi
push dword [ebp - 8]
call fcn.7cf69f6a
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
je 0x7cfcea60
lea edx, [ebp - 0x340]
push edx
push 0x8000
push dword [ebp - 4]
push eax
call dword [ecx + 0x2c]
test eax, eax
jl 0x7cfcea4d
lea eax, [ebp - 0x238]
push 0x104
push eax
lea eax, [ebp - 0x340]
push dword [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRetToBufW]
test eax, eax
jl 0x7cfcea4d
lea eax, [ebp - 0x238]
push eax
call edi
mov word [ebp + eax*2 - 0x236], si
lea eax, [ebp - 0x30]
push eax
call sym.SHELL32.dll_SHFileOperationW
push dword [ebp - 4]
call sym.SHELL32.dll_ILFree
lea ecx, [ebp - 4]
mov eax, ebx
push ecx
push esi
inc ebx
push eax
jmp 0x7cfce9ea
push eax
call dword [ecx + 8]
push dword [ebp - 8]
call dword [sym.imp.COMCTL32.dll_FreeMRUList]
push dword [ebp - 0xc]
call sym.SHELL32.dll_ILFree
push 1
push reloc.SHLWAPI.dll_ParseURLA
call fcn.7cf5afcc
mov edi, eax
cmp edi, esi
je 0x7cfcea9a
push 0x7cf3ee68
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.7cfce7d6
push esi
push esi
push 0x1000
push esi
call sym.SHELL32.dll_SHChangeNotify
pop edi
call fcn.7cfc5ab7
pop esi
pop ebx
leave
ret
Function at 0x7cfcff05
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
mov eax, dword [ebp + 0xc]
push ebx
push esi
dec eax
push edi
je 0x7cfcff6e
dec eax
je 0x7cfcff61
sub eax, 0x3742
jne 0x7cfd00d2
cmp dword [ebp + 0x14], 0x300
jne 0x7cfd00d2
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 4
push eax
push 0x3744
mov word [ebp - 8], 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
movzx eax, word [ebp - 8]
push eax
push dword [esi + 0x20]
call fcn.7cfcf7e3
jmp 0x7cfd00d2
mov eax, dword [ebp + 8]
push 0
push dword [eax + 0x20]
jmp 0x7cfd00cc
mov esi, dword [ebp + 8]
push 1
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
pop edi
push 0
push 9
push 0x110a
push dword [esi + 0x24]
call ebx
push eax
mov dword [ebp + 8], eax
push dword [esi + 0x24]
call fcn.7cfcf28a
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 8]
test eax, eax
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x20], eax
jne 0x7cfcffb7
lea eax, [ebp - 0x74c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], 0x104
push eax
push 0
push 0x113e
push dword [esi + 0x24]
call ebx
test byte [esi + 0x14], 0x10
je 0x7cfd00b7
mov ebx, 0x104
lea eax, [ebp - 0x544]
push ebx
push eax
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x238]
push ebx
push eax
lea eax, [ebp - 0x544]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
push dword [ebp - 0x20]
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7cfd00b7
lea eax, [ebp - 0x238]
push eax
call sym.SHELL32.dll_ILCreateFromPath
test eax, eax
mov dword [ebp + 8], eax
je 0x7cfd0052
push dword [esi + 0x34]
call sym.SHELL32.dll_ILFree
mov eax, dword [ebp + 8]
mov dword [esi + 0x34], eax
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
or dword [ebp - 0x18], 0xffffffff
jmp 0x7cfd00b7
test byte [esi + 0x14], 0x20
je 0x7cfd00b7
push dword [esi + 0x34]
call sym.SHELL32.dll_ILFree
mov eax, dword [ebp - 0x20]
and dword [esi + 0x34], 0
and word [eax], 0
or dword [ebp - 0x18], 0xffffffff
test byte [esi + 0x38], 2
lea eax, [ebp - 0x238]
jne 0x7cfd0096
lea eax, [ebp - 0x33c]
push ebx
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToAnsi]
lea eax, [ebp - 0x33c]
push eax
mov eax, dword [esi + 0x38]
shl eax, 0x1e
sar eax, 0x1f
neg al
sbb eax, eax
neg eax
add eax, 3
push eax
push esi
call fcn.7cfcf220
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x7cfd00c3
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
test edi, edi
je 0x7cfd00d2
push 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
pop ebx
leave
ret 0x10