joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d01c42a
Capabilities:
Log keystrokes

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push edi
mov cx, word [esi]
test cx, cx
je 0x7d01c491
movzx eax, cx
push 1
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov cl, byte [esi + 6]
test cl, 2
je 0x7d01c469
push 0x60
pop edx
movzx edi, dx
cmp ax, word [edi*2 + 0x7d04c1e0]
je 0x7d01c467
inc edx
cmp dx, 0x69
jbe 0x7d01c451
jmp 0x7d01c469
mov eax, edx
test cl, 1
je 0x7d01c471
or ah, 8
mov cx, word [esi + 2]
test cl, 3
je 0x7d01c47d
or ah, 1
test cx, 0xc004
je 0x7d01c487
or ah, 2
test cx, 0x3008
je 0x7d01c491
or ah, 4
pop edi
pop esi
ret 4

Function at 0x7d01c496
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp bx, ax
mov word [esi], ax
mov word [esi + 2], ax
mov word [esi + 4], ax
mov byte [esi + 6], al
je 0x7d01c4fc
push eax
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test bh, 8
mov word [esi], ax
mov word [esi + 4], 0xf
je 0x7d01c4d2
or byte [esi + 6], 1
movzx eax, bx
sub eax, 0x60
cmp eax, 0xa
jge 0x7d01c4e1
or byte [esi + 6], 2
test bh, 1
je 0x7d01c4ea
or byte [esi + 2], 3
test bh, 2
je 0x7d01c4f3
or byte [esi + 2], 4
test bh, 4
je 0x7d01c4fc
or byte [esi + 2], 8
pop esi
pop ebx
ret 8

Function at 0x7d01cbfa
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esp + 8]
call dword [sym.imp.USER32.dll_EnableWindow]
ret 4

Function at 0x7d01ce50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 1
push esi
push dword [ebp + 8]
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7d01cea9
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x7cf46d38
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7d01cea0
cmp dword [ebp - 8], esi
setne al
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4

Function at 0x7d01cf55
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp + 8]
xor esi, esi
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 8]
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x7d01cfa5
xor eax, eax
cmp dword [ebp + 0x10], esi
push 4
setne al
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 0xc
Function at 0x7d01cfaa
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
xor esi, esi
push 1
push esi
push dword [ebp + 8]
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x7d01d043
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
call ebx
cmp edi, esi
jne 0x7d01d043
lea eax, [ebp + 8]
push esi
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 8]
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x7d01d03e
push dword [ebp - 4]
lea eax, [ebp - 0x88]
push eax
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
push dword [ebp + 8]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7d01d083
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push 0x7cf47068
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x208]
push 0
push eax
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x7d01d0ee
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x7d01d0f5
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push 0x104
push eax
push dword [ebp + 8]
call fcn.7d01d083
test eax, eax
jne 0x7d01d13d
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0xc], 0
je 0x7d01d12d
and al, 0xf9
jmp 0x7d01d12f
or al, 6
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
leave
ret 8
Function at 0x7d01d141
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1668
call fcn.7d041c90
push ebx
lea eax, [ebp - 0x668]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x7d01d2ba
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x7d01d2ad
lea eax, [ebp - 0x258]
push eax
push 0x7cf470d8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x7d01d2ad
lea eax, [ebp + 8]
push edi
push eax
push 0x7cf39820
xor edi, edi
push 1
push edi
push 0x7cf39a20
call fcn.7cf4d6fc
cmp eax, edi
jl 0x7d01d2a3
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x7cf4c360
mov ecx, dword [eax]
push eax
call dword [ecx]
cmp eax, edi
jl 0x7d01d29a
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x22c]
push edi
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x7d01d278
mov eax, dword [ebp + 8]
push edi
push edi
lea edx, [ebp - 0x460]
mov ecx, dword [eax]
push ebx
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x7d01d278
lea eax, [ebp - 0x460]
push eax
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x7d01d22a
lea eax, [ebp - 0x460]
push eax
push dword [ebp + 0x10]
call esi
test eax, eax
jne 0x7d01d278
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1668]
push 0x800
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
test eax, eax
jl 0x7d01d278
lea eax, [ebp - 0x1668]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
cmp word [ebp - 0x1668], di
jne 0x7d01d278
lea eax, [ebp - 0x22c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7d01d1da
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop esi
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop ebx
leave
ret 0xc
Function at 0x7d01d414
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push esi
push 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop ebx
push ebx
push esi
push esi
push esi
push 0x7cf46e38
push reloc.SHLWAPI.dll_ParseURLA
call edi
cmp eax, esi
jne 0x7d01d4c3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x7cf46ef8
push dword [ebp - 0xc]
call edi
cmp eax, esi
jne 0x7d01d4ba
lea eax, [ebp - 0x14]
mov edi, 0x7cf46f10
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x7d01d484
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x7d01d48f
and byte [ebp - 2], 0xef
jmp 0x7d01d493
or byte [ebp - 2], 0x10
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call fcn.7d01cdac
push 0x10
call fcn.7d01cdac
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7d01d50e
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov esi, ParseURLA
jne 0x7d01d56a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x7cf471b4
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 1
pop ecx
cmp dword [ebp - 4], ecx
jne 0x7d01d562
cmp eax, 0xea
je 0x7d01d565
cmp eax, ebx
jne 0x7d01d562
cmp dword [ebp - 8], 4
jae 0x7d01d565
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], ebx
je 0x7d01d5b1
mov edi, 0x7cf471a4
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x7d01d5b1
push ebx
push dword [ebp + 8]
push 0x7cf47134
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7d01d5b8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp + 0xc]
push esi
push eax
xor esi, esi
push 3
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x7d01d663
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x208]
push eax
push esi
push esi
mov dword [ebp + 8], 0x208
push dword [ebp + 0xc]
call fcn.7d01cd5c
cmp dword [ebp + 0x14], esi
je 0x7d01d62a
cmp dword [ebp + 0x18], esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x7d01d61d
cmp eax, esi
jne 0x7d01d61d
lea eax, [ebp - 0x208]
push eax
call edi
test eax, eax
jne 0x7d01d659
push dword [ebp + 0x10]
call edi
shl eax, 1
push eax
push dword [ebp + 0x10]
jmp 0x7d01d64d
cmp dword [ebp + 0x18], esi
jne 0x7d01d647
cmp eax, esi
jne 0x7d01d659
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x7d01d659
push esi
push 0x7cf32b54
push 1
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 0x14

Function at 0x7d01d668
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 0x18]
push esi
lea eax, [ebp - 0x208]
push 2
push eax
push 0
call sym.SHELL32.dll_Ordinal_175
test eax, eax
je 0x7d01d6a0
push esi
lea eax, [ebp - 0x208]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.7d01d2bf
push esi
lea eax, [ebp - 0x208]
push 0x1a
push eax
push 0
call sym.SHELL32.dll_Ordinal_175
test eax, eax
je 0x7d01d70b
lea eax, [ebp - 0x410]
push 0x104
push eax
push 0x1300
call fcn.7d01cd08
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
lea eax, [ebp - 0x208]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.7d01d2bf
pop esi
leave
ret 0x14

Function at 0x7d01ddee
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0xbe
push 0x7cf466d8
push 2
mov esi, 0x7cf465d8
push 0x7cf46660
mov ebx, reloc.SHLWAPI.dll_ParseURLW
push esi
push ebx
call edi
mov ebp, 0xb4
push ebp
push 0x7cf46798
push 2
push 0x7cf46688
push esi
push ebx
call edi
push ebp
push 0x7cf46850
push 2
push 0x7cf466b0
push esi
push ebx
call edi
push 0x7cf469f8
call fcn.7d01ce50
push eax
push 0x7cf46640
push esi
call fcn.7d01cf55
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x7d01df9d
Capabilities:
Get common file path
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x62c]
push eax
mov ebx, reloc.SHLWAPI.dll_ParseURLW
push dword [0x7d04c328]
mov esi, 0x208
mov dword [ebp - 4], esi
push dword [0x7d04c320]
push ebx
call fcn.7d01cd5c
xor edi, edi
cmp eax, edi
jne 0x7d01dfe2
cmp word [ebp - 0x62c], di
jne 0x7d01dfec
push 0x7d04c320
call fcn.7d01d710
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x62c]
push eax
push dword [0x7d04c33c]
push dword [0x7d04c334]
push ebx
call fcn.7d01cd5c
cmp eax, edi
jne 0x7d01e01d
cmp word [ebp - 0x62c], di
jne 0x7d01e12e
mov word [ebp - 0x21c], di
mov edi, 0x104
lea eax, [ebp - 0x834]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x834]
push 0x7cf47278
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x21c]
push edi
push eax
push 0x7cf32b54
push 0x7cf47260
push 0x7cf47250
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov si, word [ebp - 0x21c]
lea eax, [ebp - 0x21c]
neg si
sbb esi, esi
mov dword [ebp - 4], edi
and esi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x424]
push eax
push 0x7cf46d60
push dword [0x7d04c338]
push ebx
call fcn.7d01cd5c
xor edi, edi
cmp eax, edi
je 0x7d01e0ad
mov word [ebp - 0x424], di
cmp word [ebp - 0x424], di
je 0x7d01e0ff
cmp word [ebp - 0x21c], di
je 0x7d01e0ff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.7d01df00
test eax, eax
jl 0x7d01e0ff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.7d01df00
test eax, eax
jl 0x7d01e0ff
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jl 0x7d01e0ff
jg 0x7d01e0f9
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jbe 0x7d01e0ff
lea esi, [ebp - 0x424]
cmp esi, edi
je 0x7d01e12e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x21c]
push eax
push 1
push dword [0x7d04c33c]
push dword [0x7d04c334]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x7cf46938
call fcn.7d01ce50
push eax
push 0x7cf46508
call fcn.7d01d0f5
push 0x7cf469f8
call fcn.7d01ce50
push eax
push 0x7cf46528
call fcn.7d01d0f5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7d01e3c7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
cmp dword [esp + 0x10], ebp
push edi
je 0x7d01e428
cmp dword [0x7d04e9b4], ebp
je 0x7d01e428
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x7d04e9b8]
cmp eax, 0x7530
jae 0x7d01e428
push dword [esp + 0x14]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call esi
push dword [0x7d04e9b4]
mov edi, eax
call esi
mov esi, 0x7d04ce10
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7d01e421
push 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x7d04e9b8], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 4

Function at 0x7d01f052
Capabilities:
Get explorer pid

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.USER32.dll_GetShellWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 8]
push ecx
push eax
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, dword [ebp - 8]
pop esi
sete al
leave
ret 4
Function at 0x7d020573
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x7cf47c54
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x7d0205cc
push esi
lea eax, [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
push eax
push 4
push 0
push 0x7cf47c30
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 0xc]
shl eax, 4
push eax
push dword [ebp + 8]
push 3
push 0
push 0x7cf47c0c
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 8
Function at 0x7d020644
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
xor edi, edi
cmp dword [0x7d04e9cc], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 4
mov esi, reloc.SHLWAPI.dll_ParseURLA
jne 0x7d020695
lea eax, [ebp - 4]
push eax
push 0x7d04e9cc
push edi
push 0x7cf47dcc
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x7d020695
mov dword [0x7d04e9cc], 0xc8
mov eax, dword [0x7d04e9cc]
push dword [ebp + 8]
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x7d020608
call sym.SHELL32.dll_ILGetSize
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.7d037805
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x7d0206e1
xor eax, eax
jmp 0x7d0207c9
cmp dword [ebp - 8], edi
jge 0x7d0206f0
test byte [ebp + 0xc], 3
je 0x7d0207be
push 1
push dword [ebp + 0x18]
push esi
call fcn.7cf50bf3
cmp eax, edi
mov dword [ebp + 0x14], eax
je 0x7d0207be
push ebx
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.7d037b26
push eax
lea eax, [ebp - 0x68]
push 0x7cf34808
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp - 8], edi
jge 0x7d02079f
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7d02079f
push 0x40
lea eax, [ebp + 0x18]
pop ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push edi
push edi
push eax
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], ebx
push eax
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x7d020796
lea eax, [ebp - 0xe8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x7d020796
push edi
lea eax, [ebp + 0x18]
push edi
push eax
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0xe8]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
jmp 0x7d020761
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
lea eax, [ebp - 0x68]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
push dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call fcn.7d037ac3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7d021149
Capabilities:
Delete registry key
Get common file path
Get geographical location
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
push ebx
push esi
push edi
lea eax, [ebp - 0x2d8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, 0x7cf48094
lea eax, [ebp - 0x2d8]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x7d0211ca
lea eax, [ebp - 0x2d8]
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsAndAttributesW]
test eax, eax
je 0x7d0211ca
push esi
lea eax, [ebp - 0xd0]
push 0x64
push eax
mov ebx, 0x7cf48084
push 0x7cf32b54
mov edi, 0x7cf48074
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0xd0], 0
jne 0x7d0211ca
push esi
push 0x7cf48064
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 4]
xor ebx, ebx
push eax
lea eax, [ebp - 0x2d8]
push eax
push ebx
mov edi, 0x7cf48058
push ebx
mov esi, ParseURLA
push edi
push esi
mov dword [ebp - 4], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x2d8]
push 0x7cf48044
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x7d02121a
push 0x10
push 0x7cf48034
push 1
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x7cf35164
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 8]
push eax
push 0x7cf39470
push 1
push ebx
push 0x7cf39450
call fcn.7cf4d6fc
test eax, eax
jl 0x7d021284
lea eax, [ebp - 4]
mov esi, 0x7cf39d30
push eax
push 0x7cf396a0
push 1
push ebx
push esi
call fcn.7cf4d6fc
test eax, eax
jl 0x7d02127b
mov eax, dword [ebp - 8]
push 0x10000000
push ebx
push esi
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call sym.SHELL32.dll_Ordinal_711
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7d02187b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
sub eax, 0x458
push edi
mov esi, ecx
jne 0x7d021974
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x7d021974
mov eax, dword [esi + 0x4c]
lea edi, [ebp - 0xc]
push 0x10
mov eax, dword [eax]
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x10], 0xf0001
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
cmp ecx, ebx
mov dword [ebp + 8], ecx
je 0x7d02192f
mov eax, dword [esi + 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14c]
mov edi, eax
dec edi
js 0x7d02192f
mov eax, dword [esi + 0x2c]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x150]
cmp eax, ebx
je 0x7d0218e9
mov eax, dword [eax]
cmp eax, ebx
je 0x7d0218e9
mov ecx, dword [eax]
lea edx, [ebp + 0xc]
push edx
push 0x7cf39770
push eax
call dword [ecx]
test eax, eax
jl 0x7d0218e9
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x1c]
push edx
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x7d021974
mov eax, dword [esi + 0x4c]
push ebx
push 0x10002
push 0x128
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp + 8], ebx
je 0x7d021960
mov eax, dword [esi + 0x4c]
mov eax, dword [eax + 0x30]
cmp eax, ebx
je 0x7d021960
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x14]
jmp 0x7d021974
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x2c]
push ebx
push dword [edx + 0x38]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x16c]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc

Function at 0x7d022434
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
push 0
push dword [esp + 0xc]
push 0x7cf358cc
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
ret 4