joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cf9d0ec
Capabilities:
Access pe header
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7cf36d48
push 0x7d041db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x1c], edi
push edi
push 0x8000080
push 3
push edi
push 3
push ParseURLA
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x7cf9d220
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, 0x10000
cmp esi, eax
jbe 0x7cf9d153
mov esi, eax
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, edi
je 0x7cf9d217
push edi
push esi
push edi
push 0x1000002
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x2c], eax
cmp eax, edi
je 0x7cf9d1eb
push esi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x30], eax
cmp eax, edi
je 0x7cf9d1d7
mov dword [ebp - 4], edi
mov ecx, esi
mov esi, eax
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x7cf9d1c6
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor edi, edi
jmp 0x7cf9d1e0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7cf9d1f4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
cmp ebx, edi
je 0x7cf9d217
push ebx
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x7cf9d210
test byte [eax + 0x5f], 0x80
je 0x7cf9d210
mov dword [ebp - 0x1c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7cf9d267
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x7cf9d283
xor eax, eax
jmp 0x7cf9d2d4
test ah, 1
jne 0x7cf9d2d1
lea eax, [ebp - 0x410]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x208]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.7cfaf255
test eax, eax
jne 0x7cf9d2d1
push dword [ebp + 8]
push 0x20
call fcn.7cfaf255
test eax, eax
je 0x7cf9d2d4
push 1
pop eax
pop esi
leave
ret 4
Function at 0x7cf9d78f
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
cmp eax, 0xffffffff
jne 0x7cf9d7b5
cmp dword [esp + 8], esi
je 0x7cf9d7ad
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x7cf9d7b0
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x7cf9d7bd
test ah, 0x10
je 0x7cf9d7bd
push 1
pop esi
mov eax, esi
pop esi
ret 8

Function at 0x7cf9db23
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.7cfb0f7a
test eax, eax
je 0x7cf9dc91
mov esi, 0x104
lea eax, [ebp - 0x224]
push esi
push eax
push dword [ebp + 8]
call fcn.7cfb31f5
cmp eax, edi
jne 0x7cf9dc7e
lea eax, [ebp - 0x224]
push eax
call sym.SHELL32.dll_PathIsExe
test eax, eax
je 0x7cf9dc91
lea eax, [ebp + 8]
mov dword [ebp - 0x18], edi
push eax
push 0x20019
push edi
push 0x7cf36db0
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cf9dc40
lea eax, [ebp - 0x224]
mov dword [ebp - 8], 0x208
push eax
mov dword [ebp - 0xc], esi
call sym.SHELL32.dll_PathFindFileName
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x10], edi
push eax
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
call edi
test eax, eax
jne 0x7cf9dc35
cmp dword [ebp - 0x14], 1
jne 0x7cf9dbfd
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x7cf9dc2e
lea eax, [ebp - 8]
inc dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 8], 0x208
push eax
mov dword [ebp - 0xc], esi
push dword [ebp - 0x10]
push dword [ebp + 8]
jmp 0x7cf9dbdd
mov dword [ebp - 0x18], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [ebp - 0x18], edi
jne 0x7cf9dc79
push edi
lea eax, [ebp - 0x42c]
push 0x26
push eax
push edi
call sym.SHELL32.dll_Ordinal_175
test eax, eax
je 0x7cf9dc91
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.7cf9d97c
test eax, eax
je 0x7cf9dc91
mov dword [ebp - 4], 1
jmp 0x7cf9dc91
mov dword [ebp - 4], edi
jmp 0x7cf9dc91
push 1
pop ecx
cmp eax, ecx
jne 0x7cf9dc91
cmp word [ebp - 0x224], di
je 0x7cf9dc91
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x7cf9df17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x7cf377ec
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [ebp + 0xc]
mov esi, eax
test ebx, ebx
je 0x7cf9dfc8
cmp dword [ebp + 0x10], edi
je 0x7cf9dfc8
call fcn.7d03f9f2
push eax
movzx eax, word [ebp + 8]
shr eax, 4
inc eax
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x7cf9dfb1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x7cf9dfb1
and dword [ebp + 8], 0xf
movzx ecx, word [eax]
mov edx, dword [ebp + 8]
inc eax
inc eax
dec dword [ebp + 8]
test edx, edx
je 0x7cf9df87
lea eax, [eax + ecx*2]
jmp 0x7cf9df73
dec dword [ebp + 0x10]
cmp ecx, dword [ebp + 0x10]
jle 0x7cf9df92
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + ecx]
mov esi, eax
mov ecx, edx
mov edi, ebx
mov eax, ecx
push 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and word [ebx + edx], 0
pop edi
test edi, edi
jne 0x7cf9dfc8
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x7cf9dffe
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x7cf9e02c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x7cf9e09e
and eax, 0xffff
or eax, 0x80070000
jmp 0x7cf9e09e
test al, 0x10
je 0x7cf9e034
xor eax, eax
jmp 0x7cf9e09e
xor esi, esi
push esi
lea eax, [ebp - 0x40]
push 0x7cf37894
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x248]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x7cf9e08e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x7cf9e08e
inc esi
jmp 0x7cf9e090
xor esi, esi
test esi, esi
je 0x7cf9e099
cmp esi, 0x32
jl 0x7cf9e036
mov eax, 0x80070003
pop esi
leave
ret 4
Function at 0x7cf9e17a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp + 8]
push edi
and word [esi], 0
push eax
push 0x7cf3791c
push dword [ebp + 0xc]
push ebx
call fcn.7cf9e0a3
mov edi, eax
test edi, edi
jl 0x7cf9e23e
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebx + 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7cf9e20a
cmp dword [ebp + 0x10], 1
jne 0x7cf9e1ef
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x7cf9e20a
cmp dword [ebp + 0x10], 2
jne 0x7cf9e20a
push 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
push dword [ebp + 0xc]
call fcn.7cf9dd45
xor edi, edi
cmp word [esi], di
jne 0x7cf9e216
push 1
pop edi
jmp 0x7cf9e235
push esi
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
jne 0x7cf9e235
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x7cf9e235
mov word [esi], di
mov edi, 0x80070057
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x7cf9e247
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
push esi
call fcn.7cf9dffe
mov edi, eax
mov eax, 0x80070005
cmp edi, eax
je 0x7cf9e30c
test edi, edi
je 0x7cf9e30a
cmp dword [ebp + 8], 0
je 0x7cf9e2ca
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
je 0x7cf9e290
push 0
push esi
push dword [ebp + 8]
call sym.SHELL32.dll_SHValidateUNC
test eax, eax
je 0x7cf9e2ca
jmp 0x7cf9e2c2
mov ax, word [esi]
dec eax
and eax, 0x1f
push eax
call fcn.7cfc0648
test eax, eax
je 0x7cf9e2ca
lea eax, [ebp - 8]
push eax
mov ax, word [esi]
dec eax
and eax, 0x1f
push eax
call fcn.7cfaf31e
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.7cf8350c
test eax, eax
jne 0x7cf9e2ca
push esi
call fcn.7cf9dffe
mov edi, eax
test edi, edi
je 0x7cf9e30a
test byte [ebp + 0x11], 0x80
je 0x7cf9e30a
push esi
push 0
call sym.SHELL32.dll_SHCreateDirectory
test eax, eax
jle 0x7cf9e2ea
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jne 0x7cf9e30a
mov eax, dword [ebp + 0xc]
test byte [eax + 0x10], 0x40
je 0x7cf9e30a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or al, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
pop edi
pop esi
leave
ret 0x10
Function at 0x7cf9e8d3
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.7cf9e4cb
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x7cf9e993
lea eax, [ebp + 8]
push eax
push 0x7cf3791c
push edi
push esi
call fcn.7cf9e0a3
test eax, eax
jl 0x7cf9e9ab
lea eax, [ebp - 0x208]
push eax
push dword [esi + 8]
push dword [ebp + 8]
call fcn.7cf9dfcf
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7cf9e946
push edi
push dword [ebp + 0xc]
push dword [esi + 8]
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHRegSetPathW]
mov ebx, eax
jmp 0x7cf9e948
xor ebx, ebx
push edi
push 0x7cf37d40
push esi
call fcn.7cf50c73
cmp ebx, edi
jne 0x7cf9e988
lea eax, [ebp + 0xc]
push eax
push 0x8000
push esi
push edi
call fcn.7cf9e423
test eax, eax
jne 0x7cf9e976
push dword [ebp + 0xc]
call sym.SHELL32.dll_ILFree
jmp 0x7cf9e988
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call fcn.7cf9e4cb
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7cf9e9ab
push edi
push 0x7cf3791c
push esi
call fcn.7cf50c73
push edi
push 0x7cf37d40
push esi
call fcn.7cf50c73
push dword [0x7d04ce88]
call dword [sym.imp.SHLWAPI.dll_Ordinal_224]
pop edi
pop esi
mov dword [0x7d04ce8c], eax
pop ebx
leave
ret 8
Function at 0x7cf9f1ea
Capabilities:
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push edi
push 0x7cf37f10
push dword [ebp + 0xc]
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9edc0
test eax, eax
jne 0x7cf9f232
mov dword [ebp - 4], 1
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9f002
test eax, eax
jne 0x7cf9f248
or dword [ebp - 4], 2
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9ed66
test eax, eax
jne 0x7cf9f25e
or dword [ebp - 4], 4
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9ee7f
test eax, eax
jne 0x7cf9f274
or dword [ebp - 4], 8
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9eefe
test eax, eax
jne 0x7cf9f28a
or dword [ebp - 4], 0x40
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9ed93
test eax, eax
jne 0x7cf9f2a0
or dword [ebp - 4], 0x10
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9ef7b
test eax, eax
jne 0x7cf9f2b6
or dword [ebp - 4], 0x10
lea eax, [ebp - 0x238]
push ebx
push eax
push esi
call fcn.7cf9ed39
test eax, eax
jne 0x7cf9f2cc
or dword [ebp - 4], 0x20
test bl, 2
je 0x7cf9f348
test bl, 1
mov dword [ebp + 0x10], 1
mov edi, 0x7cf32e8c
je 0x7cf9f312
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x30]
push 0x14
push eax
push 0x7cf37f08
push 0x7cf32eac
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
test eax, eax
jl 0x7cf9f312
and dword [ebp + 0x10], 0
cmp dword [ebp + 0x10], 0
je 0x7cf9f330
lea eax, [ebp - 0x238]
push eax
push 0x7cf37f04
push 0x7cf32eac
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x238]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
test bl, 1
je 0x7cf9f366
cmp dword [esi + 4], 0
je 0x7cf9f360
cmp dword [ebp - 4], 0
jne 0x7cf9f360
mov dword [ebp - 8], 0x80004005
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7cf9fb21
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, 0x104
lea eax, [ebp - 0x208]
push esi
push eax
push dword [0x7d04cdfc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x410]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x208]
push eax
push ecx
push eax
lea eax, [ebp - 0x410]
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x7cf9fb9b
push 0x7cf37f48
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x7cf9fbab
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop esi
leave
ret 4

Function at 0x7cf9fef0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xa0
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
push 0x50
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebp, 0x104
lea edi, [esi + 0x21c]
push ebp
mov ebx, 0x3002
push edi
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
cmp word [edi], 0x22
je 0x7cf9ff3a
push edi
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
lea eax, [esp + 0x10]
push eax
push 0x233c
push 0x233b
push 0
push ebp
push edi
push dword [esi + 0xc]
call sym.SHELL32.dll_GetFileNameFromBrowse
test eax, eax
je 0x7cf9ff82
push edi
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push edi
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
push 1
push 0x401
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
pop eax
jmp 0x7cf9ff84
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret 4

Function at 0x7cfa0cd0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp word [esi], 0x5c
jne 0x7cfa0d45
cmp word [esi + 2], 0x5c
jne 0x7cfa0d45
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x7cfa0d47
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 4]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_IntlStrEqWorkerW]
test eax, eax
je 0x7cfa0d47
mov eax, dword [ebp + 8]
cmp word [esi + eax*2], 0x5c
jne 0x7cfa0d47
cmp word [esi + eax*2 + 2], 0x5c
lea ecx, [esi + eax*2 + 2]
jne 0x7cfa0d47
cmp word [esi + eax*2 + 4], 0x5c
jne 0x7cfa0d47
mov ebx, ecx
jmp 0x7cfa0d47
mov ebx, esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7cfa0d50
mov dword [eax], ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
Function at 0x7cfa3a68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
lea eax, [ebp - 0x204]
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x7cf3832c
push 0x100
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov esi, dword [ebp + 0x10]
add esp, 0x10
lea eax, [ebp + 0x14]
push eax
push esi
push ebx
lea eax, [ebp - 0x204]
push ebx
push eax
push ParseURLA
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x7cfa3acf
cmp dword [ebp + 0x14], ebx
je 0x7cfa3acf
push esi
call dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 4], esi
mov dword [ecx], eax
jmp 0x7cfa3b89
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, ebx
mov dword [ebp + 0x10], ebx
je 0x7cfa3afb
cmp dword [eax + 0x14], ebx
je 0x7cfa3afb
mov eax, dword [eax + 0x1c]
cmp eax, ebx
je 0x7cfa3afb
push dword [ebp + 0xc]
push eax
call fcn.7cfa3a19
mov edi, eax
cmp edi, ebx
je 0x7cfa3afb
mov ebx, dword [edi + 0xc]
jmp 0x7cfa3b26
push ebx
push dword [ebp + 0xc]
call fcn.7cfa0cd0
test eax, eax
je 0x7cfa3b0d
push 0x10
pop ebx
jmp 0x7cfa3b26
push 5
push dword [ebp + 0xc]
call fcn.7cfa04ea
mov edi, eax
cmp edi, ebx
je 0x7cfa3b26
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
mov dword [ebp + 0x10], eax
push ebx
push dword [ebp + 0xc]
call fcn.7cfa09c7
test bl, 0x10
mov esi, eax
je 0x7cfa3b45
neg esi
sbb esi, esi
and esi, 0x1d
add esi, 0x8c
jmp 0x7cfa3b79
cmp dword [ebp + 0x10], 0
je 0x7cfa3b6c
push 0x7cf380b0
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x7cfa3b6c
neg esi
sbb esi, esi
and esi, 0x1d
add esi, 0x8d
jmp 0x7cfa3b79
neg esi
sbb esi, esi
and esi, 0x97
add esi, 0x11
mov eax, dword [ebp + 0x18]
test edi, edi
mov dword [eax], esi
je 0x7cfa3b89
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7cfa4482
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
lea eax, [edi*4 + 8]
mov dword [ebp - 4], ebx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x7cfa4573
xor ecx, ecx
cmp edi, ebx
lea eax, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], edi
jbe 0x7cfa44c9
mov dword [eax], ebx
inc ecx
add eax, 4
cmp ecx, dword [esi + 4]
jb 0x7cfa44be
lea eax, [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x7cfa4573
lea eax, [ebp + 0x10]
push eax
push 0x7cf33430
push dword [ebp + 0xc]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x7cfa456e
xor edi, edi
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jae 0x7cfa4562
lea eax, [ebp - 0x84]
push 0x40
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x7cfa4562
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
call fcn.7cf5aef1
test eax, eax
jne 0x7cfa455f
push dword [ebp + 0x14]
lea eax, [ebp - 0x28c]
push dword [ebp + 8]
push eax
mov eax, dword [esi]
lea eax, [esi + eax*4 + 8]
push eax
call fcn.7cfa4421
test eax, eax
je 0x7cfa455f
inc dword [esi]
inc edi
jmp 0x7cfa44fd
push dword [ebp + 0x10]
call ebx
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
call ebx
cmp dword [ebp - 4], 0
jne 0x7cfa4581
push esi
call sym.SHELL32.dll_SHDestroyPropSheetExtArray
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7cfa489e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
lea eax, [ebp - 4]
push eax
push 0x7cf38388
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cfa49e3
push ebx
lea eax, [ebp - 0xb0]
xor ebx, ebx
push 0x50
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x7cfa49d9
push edi
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov edi, 0x7cf3837c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 4]
call fcn.7cf5aef1
test eax, eax
jne 0x7cfa493d
lea eax, [ebp - 0x2b8]
push eax
call esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x2b8]
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xb0]
push ebx
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cfa49b7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x2b8]
push eax
push ebx
push ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7cfa49ae
lea eax, [ebp - 0x2b8]
push 0x3b
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x7cfa498d
mov word [eax], bx
lea eax, [ebp - 0x2b8]
push eax
call esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x2b8]
push dword [ebp + 0x10]
push eax
push edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
lea eax, [ebp - 0xb0]
push 0x50
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x7cfa48f1
pop esi
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
push 1
pop eax
leave
ret 0x10