joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d037a90
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x7d037abb
push eax
call fcn.7d037a7c
shl eax, 2
push eax
push dword [esi + 0x10]
push 3
push 0
push 0x7cf3e108
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
and byte [esi + 1], 0xef
pop esi
ret 4

Function at 0x7d037b26
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
push edi
mov eax, dword [esi]
not eax
shr eax, 1
and eax, 1
test esi, esi
mov dword [ebp - 0xc], eax
je 0x7d037b87
mov ebx, dword [esi + 4]
and dword [ebp + 8], 0
lea edi, [esi + 0x14]
test ebx, ebx
mov dword [ebp - 8], edi
jbe 0x7d037b81
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x7d037b75
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push esi
call fcn.7d0377c6
test eax, eax
jne 0x7d037c77
inc dword [ebp + 8]
add dword [ebp - 8], 4
cmp dword [ebp + 8], ebx
jb 0x7d037b57
test byte [esi + 1], 0x80
je 0x7d037b8f
or eax, 0xffffffff
jmp 0x7d037c70
xor eax, eax
test ebx, ebx
jbe 0x7d037ba2
cmp dword [edi], 0
je 0x7d037baf
inc eax
add edi, 4
cmp eax, ebx
jb 0x7d037b95
mov eax, dword [esi + 0x10]
mov ebx, dword [eax + ebx*4 - 4]
lea edi, [esi + ebx*4 + 0x14]
jmp 0x7d037bb1
mov ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push dword [edi]
call dword [sym.imp.COMCTL32.dll_Ordinal_72]
test eax, eax
mov dword [edi], eax
je 0x7d037c0a
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [edi]
push ecx
add eax, 4
push dword [ebp + 0xc]
push eax
call fcn.7d041e90
add esp, 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push 0xf
push eax
push ebx
call fcn.7d0375fe
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push dword [ebp + 0xc]
push 3
push 0
push eax
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], 1
push ebx
push dword [esi + 0x10]
call fcn.7d037a61
test eax, eax
je 0x7d037c39
mov ecx, eax
sub ecx, dword [esi + 0x10]
sar ecx, 2
imul ecx, ecx, 0x3fffffff
add ecx, dword [esi + 4]
shl ecx, 2
push ecx
lea ecx, [eax + 4]
push ecx
push eax
call fcn.7d041e90
add esp, 0xc
cmp dword [ebp - 4], 0xffffffff
je 0x7d037c5b
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x10]
shl ecx, 2
push ecx
push eax
add eax, 4
push eax
call fcn.7d041e90
mov eax, dword [esi + 0x10]
add esp, 0xc
mov dword [eax], ebx
cmp dword [ebp - 0xc], 0
je 0x7d037c69
push esi
call fcn.7d037a90
jmp 0x7d037c6d
or byte [esi + 1], 0x10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ebx
jmp 0x7d037c0a
Function at 0x7d0380c4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x7d0380ec
mov dword [edi], ebx
mov eax, dword [edi]
cmp eax, ebx
jbe 0x7d038238
inc eax
imul eax, eax, 0x70
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov eax, dword [ebp + 0xc]
cmp esi, ebx
mov dword [eax], esi
je 0x7d038238
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
lea edi, [esi + 4]
push ebx
push eax
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0x10
push ebx
jmp 0x7d038224
push 0x2001f
push edi
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.7d036617
test eax, eax
jne 0x7d038200
lea eax, [ebp - 4]
mov edi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
lea eax, [esi + 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x7cf49fb0
mov dword [ebp - 4], 0x2c
push dword [ebp - 8]
call edi
test eax, eax
jne 0x7d038200
lea eax, [ebp - 4]
mov byte [esi], 1
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x7cf37ecc
push dword [ebp - 8]
call edi
test eax, eax
jne 0x7d0381aa
mov eax, dword [ebp - 0x18]
mov ecx, eax
shr ecx, 0xd
and cl, 1
and eax, 0xf
mov byte [esi + 1], cl
mov dword [esi + 0x28], eax
jmp 0x7d0381b4
mov byte [esi + 1], bl
mov dword [esi + 0x28], 2
lea eax, [esi + 0x24]
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [eax], 1
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x7cf49f94
mov dword [ebp - 4], 4
push dword [ebp - 8]
call edi
test eax, eax
jne 0x7d038200
test byte [esi + 0x24], 6
je 0x7d038200
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x18
push eax
lea eax, [esi + 0x58]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x7cf49f4c
push dword [ebp - 8]
call edi
add esi, 0x70
inc dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], 0x10
call fcn.7d036600
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
lea edi, [esi + 4]
push ebx
push eax
push edi
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x7d03812e
mov edi, dword [ebp + 0x10]
cmp dword [edi], ebx
je 0x7d038248
mov eax, dword [ebp + 0xc]
cmp dword [eax], ebx
je 0x7d038248
push 1
pop eax
jmp 0x7d03824a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7d038287
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0x20
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x7d03836c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
lea eax, [ebp - 0x2c]
push 0x2001f
push eax
lea ecx, [ebp - 4]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.7d036617
test eax, eax
jne 0x7d038338
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x10]
push esi
call fcn.7d038251
cmp eax, ebx
jl 0x7d038338
imul eax, eax, 0x70
add esi, eax
cmp byte [esi + 2], bl
je 0x7d038338
lea eax, [esi + 0x2c]
push 0x2c
push eax
push 3
push ebx
push 0x7cf49fb0
push dword [ebp - 4]
call edi
lea eax, [esi + 0x24]
push 4
push eax
push 3
push ebx
push 0x7cf49f94
push dword [ebp - 4]
call edi
test byte [esi + 0x24], 6
je 0x7d038338
add esi, 0x58
push 0x18
push esi
push 3
push ebx
push 0x7cf49f4c
push dword [ebp - 4]
call edi
inc dword [ebp - 0xc]
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0x20
call fcn.7d036600
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x7d0382c0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x7d03b8bc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push ebx
push esi
push edi
lea eax, [ebp - 0x208]
push dword [ebp + 8]
mov ebx, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
mov edi, 0x104
push edi
lea eax, [ebp - 0x208]
push 0x7cf4b428
push eax
call esi
push edi
lea eax, [ebp - 0x208]
push dword [ebp + 0xc]
push eax
call esi
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x7d03b956
mov eax, dword [ebp - 0x458]
and eax, 6
cmp al, 6
je 0x7d03b93d
push dword [ebp + 0x10]
lea eax, [ebp - 0x42c]
mov ecx, ebx
push eax
push dword [ebp + 8]
call fcn.7d03b7ab
lea eax, [ebp - 0x458]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7d03b91c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7d03c570
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.7d041c90
movzx eax, word [ebp + 0xc]
push ebx
push esi
sub eax, 0x7561
push edi
mov esi, ecx
je 0x7d03c63d
dec eax
je 0x7d03c60c
dec eax
jne 0x7d03c72d
movzx eax, word [ebp + 8]
dec eax
jne 0x7d03c72d
mov eax, dword [0x7d04ed8c]
xor edi, edi
lea edx, [ebp - 8]
mov dword [ebp - 8], 8
mov ecx, dword [eax]
push edi
push edx
push eax
call dword [ecx + 0x18]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0x147
push dword [esi + 0x38]
call ebx
mov dword [ebp - 4], eax
mov eax, dword [0x7d04ed8c]
lea edx, [ebp - 8]
push edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
mov ecx, esi
call fcn.7d03ba2a
push edi
mov ecx, esi
call fcn.7d03b9d7
mov esi, dword [esi + 0x30]
push edi
push esi
push 0x468
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
jmp 0x7d03c72d
xor edi, edi
push edi
push 0x7d03e519
push dword [esi + 0x30]
push 0x7503
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
jl 0x7d03c72d
push edi
mov ecx, esi
call fcn.7d03b9d7
jmp 0x7d03c715
mov eax, dword [0x7d04ed8c]
xor edi, edi
mov ebx, 0x824
push edi
mov ecx, dword [eax]
lea edx, [ebp - 0x1068]
push ebx
push edx
push eax
call dword [ecx + 0x10]
cmp dword [esi + 0x3c], edi
push 1
pop eax
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], 0x7636
mov dword [ebp - 0x1c], 0x76a0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
je 0x7d03c695
mov dword [ebp - 0x10], 3
mov dword [ebp - 8], 2
mov dword [ebp - 0x18], 0x76a2
cmp word [ebp - 0x1068], di
jne 0x7d03c6be
lea eax, [ebp - 0x1068]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x1068]
push 0x7cf35574
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1068]
push ebx
push eax
push dword [esi + 0x30]
call fcn.7d0320fe
test eax, eax
je 0x7d03c72d
lea eax, [ebp - 0x1068]
push 0x7630
push eax
push dword [esi + 0x30]
call fcn.7d032ef5
test eax, eax
je 0x7d03c72d
cmp dword [esi + 0x3c], edi
jne 0x7d03c707
lea eax, [ebp - 0x1068]
push eax
call fcn.7d03235f
test eax, eax
je 0x7d03c72d
lea eax, [ebp - 0x1068]
mov ecx, esi
push eax
call fcn.7d03bb51
mov esi, dword [esi + 0x30]
push edi
push esi
push 0x468
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7d03df71
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, 0x2000
mov ebx, 0x1000
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x7d03dff0
mov dword [ebp - 4], edi
cmp dword [ebp - 8], 0
jne 0x7d03dff0
push dword [ebp + 8]
push ebx
push esi
push 0x7cf3339c
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebx - 2]
cmp eax, ecx
jle 0x7d03dfe5
add dword [ebp - 4], 0x1000
push 2
push dword [ebp - 4]
add ebx, 0x800
mov edi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov esi, eax
test esi, esi
jne 0x7d03df99
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7d03dfec
mov dword [ebp - 8], 1
test esi, esi
jne 0x7d03df99
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7d03dff9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0x7550
push eax
mov dword [esi], eax
call edi
push 0x7551
mov dword [esi + 4], eax
push dword [esi]
call edi
and word [esi + 0xc], 0
lea edi, [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [0x7d04ed8c]
push 0
lea edx, [ebp - 0x418]
mov ecx, dword [eax]
push 0x104
push edx
push eax
call dword [ecx + 0x20]
push 0x7cf4a568
push 0x7cf4a550
call fcn.7d03df71
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
je 0x7d03e144
cmp word [ebx], ax
je 0x7d03e13b
push 0x7cf4a550
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0x7cf3339c
push ebx
push 0x7cf4a568
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x7d03e124
cmp dword [ebp - 4], 0
jne 0x7d03e0c3
lea eax, [ebp - 0x210]
push eax
push 0x7d04eda0
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7d03e0c3
mov dword [ebp + 8], 1
jmp 0x7d03e0c7
and dword [ebp + 8], 0
cmp dword [ebp + 8], 0
jne 0x7d03e0e3
lea eax, [ebp - 0x210]
push eax
call fcn.7d032331
test eax, eax
je 0x7d03e124
cmp dword [ebp + 8], 0
je 0x7d03e0ed
mov dword [ebp - 4], 1
mov dword [ebp - 8], ebx
push ebx
push 0
push 0x180
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp word [edi], 0
jne 0x7d03e124
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7d03e124
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebx + eax*2 + 2], 0
lea ebx, [ebx + eax*2 + 2]
jne 0x7d03e074
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
cmp word [ebp - 0x418], ax
jne 0x7d03e15e
cmp dword [ebp - 4], eax
je 0x7d03e15e
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x7d03e17a
cmp word [edi], ax
jne 0x7d03e17a
push 0x104
push edi
push 0x7620
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
push 0xffffffffffffffff
push 0x18c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
call fcn.7d03e210
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7d03e199
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
mov edi, ecx
push 0
push 0x188
push dword [edi + 4]
call esi
cmp eax, 0xffffffff
je 0x7d03e203
lea ecx, [ebp - 0x208]
push ecx
push eax
push 0x189
push dword [edi + 4]
call esi
mov esi, dword [ebp + 8]
push 0x7cf4a550
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push esi
push 0x7cf3339c
push eax
push 0x7cf4a568
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
call fcn.7d032331
test eax, eax
jne 0x7d03e20a
and word [esi], ax
jmp 0x7d03e20a
mov eax, dword [ebp + 8]
and word [eax], 0
pop edi
pop esi
leave
ret 8
Function at 0x7d03e353
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xc
push ebx
push edi
push dword [esp + 0x18]
and dword [esp + 0xc], 0
mov edi, ecx
push 1
push 1
push 8
mov dword [esp + 0x20], edi
pop ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmap]
test eax, eax
mov dword [esp + 0x18], eax
je 0x7d03e442
push esi
push ebp
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
test ebp, ebp
je 0x7d03e42d
push dword [esp + 0x20]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebp
call edi
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
test ebx, ebx
je 0x7d03e422
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x7d03e417
push ebx
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 1
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 8
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
push 0xcc0020
push eax
push eax
push ebp
push 8
push 8
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [esp + 0x14]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [esp + 0x18]
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebp
pop esi
mov eax, dword [esp + 8]
pop edi
pop ebx
add esp, 0xc
ret 4
Function at 0x7d03e5da
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xc
push ebx
push edi
push 0x7d04ee40
and dword [esp + 0xc], 0
push 1
push 1
push 8
pop ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
je 0x7d03e6c3
push esi
push ebp
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
test ebp, ebp
je 0x7d03e6ac
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebp
call edi
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
test ebx, ebx
je 0x7d03e6a5
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x7d03e69a
push ebx
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 1
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 8
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
push 0xcc0020
push eax
push eax
push ebp
push 8
push 8
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [esp + 0x14]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebp
pop esi
mov eax, dword [esp + 8]
pop edi
pop ebx
add esp, 0xc
ret 4

Function at 0x7d03ea27
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0x7558
push ebx
mov dword [ebp - 4], 6
call esi
mov edi, dword [sym.imp.USER32.dll_IsWindowEnabled]
push eax
call edi
test eax, eax
mov dword [ebp + 8], eax
jne 0x7d03ea6a
push 0x7559
push ebx
call esi
push eax
call edi
test eax, eax
je 0x7d03eaab
lea eax, [ebp - 0xa8]
push eax
push 0x50
push 0xd
push 0x7555
push ebx
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0xa8]
push eax
push ebx
call fcn.7d03e9a5
cmp eax, 6
mov dword [ebp - 4], eax
jne 0x7d03eaab
push 0
push dword [ebp + 8]
push 0x8000
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7d040730
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlPrefixString]
push 1
push esi
push 0x7cf4b830
call edi
test al, al
je 0x7d04078a
mov ax, word [0x7cf4b830]
cmp word [esi], ax
jbe 0x7d0408ae
mov ecx, dword [esi + 4]
movzx eax, ax
shr eax, 1
lea eax, [ecx + eax*2]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
movzx eax, word [0x7cf4b830]
movzx ecx, word [esi]
sub ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x7d0408b5
push 1
push esi
push 0x7cf4b838
call edi
test al, al
je 0x7d0408ae
mov eax, dword [esi + 4]
cmp word [eax + 0xa], 0x3a
jne 0x7d0408ae
mov esi, 0x7cf34ad8
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ax, word [eax + 8]
cmp ax, 0x61
mov word [ebp - 0xc], ax
jb 0x7d0407d1
cmp ax, 0x7a
ja 0x7d0407d1
add ax, 0xffe0
mov word [ebp - 0xc], ax
push dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x7d04080a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x7d0407f6
call esi
jmp 0x7d040802
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x7d0408b5
mov edi, 0x7cf4b840
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push edi
push esi
call sub.ntdll.dll_wcsncmp
mov edi, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
jne 0x7d04086a
mov ax, word [ebp - 0xc]
cmp ax, word [esi + 0x34]
jne 0x7d04086a
cmp word [esi + 0x36], 0x3a
jne 0x7d04086a
lea eax, [esi + 0x38]
push 0x5c
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
mov dword [edi + 4], eax
je 0x7d04086a
add eax, 2
push 4
mov dword [edi + 4], eax
sub eax, esi
sar eax, 1
shl eax, 1
pop ecx
sub ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, dword [ebp + 0x28]
and dword [eax], 0
jmp 0x7d0408b5
mov ebx, 0x7cf4b878
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push esi
call sub.ntdll.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x7d0408ae
mov esi, dword [ebp + 0x20]
push 9
push dword [ebp + 0x24]
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7d0408ae
mov ecx, dword [ebp + 0x14]
lea eax, [esi + 6]
mov dword [edi + 4], eax
mov eax, dword [esi]
mov dword [ecx], eax
jmp 0x7d0408b5
mov dword [ebp - 4], 0x800700a1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x24
Function at 0x7d0409c4
Capabilities:
Get hostname
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
xor edi, edi
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], 1
call esi
lea eax, [ebp - 0x18]
push edi
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7d040b02
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x648]
push 0x218
push eax
lea eax, [ebp - 0x430]
push 0x105
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.7d040730
mov esi, eax
cmp esi, edi
jl 0x7d040b2a
cmp dword [ebp - 0xc], edi
jne 0x7d040a8e
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x10
push eax
xor esi, esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x7d040b2a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x7d040a79
call esi
mov esi, eax
jmp 0x7d040b2a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x7d040b2a
cmp dword [ebp - 8], edi
je 0x7d040abb
cmp dword [ebp + 0xc], 0xffffffff
je 0x7d040abb
lea eax, [ebp - 0x224]
push 0x20a
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call fcn.7d0408bf
mov esi, eax
cmp esi, edi
jl 0x7d040b2a
mov edx, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
mov eax, edx
jbe 0x7d040adf
mov cx, word [eax]
cmp cx, 0x5c
je 0x7d040adf
cmp cx, 0x2e
je 0x7d040b02
inc eax
inc eax
mov ecx, eax
sub ecx, edx
cmp ecx, dword [ebp - 4]
jb 0x7d040ac5
sub eax, edx
mov cx, ax
movzx eax, cx
cmp eax, dword [ebp - 4]
mov word [ebp - 0xe], cx
mov word [ebp - 0x10], cx
jae 0x7d040b2a
cmp cx, 0x1e
ja 0x7d040b2a
lea ecx, [eax + 2]
cmp ecx, 0x20
jbe 0x7d040b09
mov esi, 0x800700a1
jmp 0x7d040b2a
mov ecx, eax
mov esi, edx
mov edx, dword [ebp + 0x10]
mov ebx, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
shr eax, 1
xor edi, edi
xor esi, esi
mov word [edx + eax*2], di
mov eax, dword fs:[0x18]
push dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x7d040ed8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
test eax, eax
jbe 0x7d040f0f
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
push 0
push 0
push 0
push dword [esi + 4]
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x7d040f06
or ebx, dword [esi]
add esi, 8
dec dword [ebp + 0x10]
jne 0x7d040eec
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc