joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cf72cc1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.7cf71c3a
lea eax, [ebp - 0x20c]
push eax
call sym.SHELL32.dll_ILCreateFromPath
mov ebx, eax
test ebx, ebx
jne 0x7cf72d24
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x7cf72d1c
push edi
call fcn.7cf74b40
test eax, eax
je 0x7cf72d1c
lea eax, [ebp - 0x20c]
push eax
call sym.SHELL32.dll_ILCreateFromPath
mov ebx, eax
test ebx, ebx
je 0x7cf72e12
push 0x40
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x7cf72e0c
lea edi, [edi*4 + 0x7d04c708]
push 0
push esi
push edi
call sub.SHLWAPI.dll_Ordinal_342
test eax, eax
je 0x7cf72da9
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call sym.SHELL32.dll_ILFree
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp dword [edi], 0xffffffff
je 0x7cf72d95
add eax, 0x3a98
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call fcn.7cf7219a
mov esi, eax
neg esi
sbb esi, esi
inc esi
call ebx
cmp eax, dword [ebp - 4]
jbe 0x7cf72d95
test esi, esi
je 0x7cf72d95
cmp dword [edi], 0xffffffff
jne 0x7cf72d6e
mov edi, dword [edi]
test edi, edi
je 0x7cf72da5
cmp edi, 0xffffffff
je 0x7cf72da5
push 1
pop eax
jmp 0x7cf72e15
xor eax, eax
jmp 0x7cf72e15
mov eax, dword [edi]
mov dword [eax + 0x34], ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
push dword [ebp + 8]
mov dword [ecx + 0x38], eax
call fcn.7cf72bb1
test eax, eax
je 0x7cf72dd8
mov ecx, dword [edi]
push 1
pop eax
mov dword [ecx], eax
mov dword [ebp - 4], eax
jmp 0x7cf72e12
push ebx
call sym.SHELL32.dll_ILFree
mov ebx, 0x7d04ce10
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi]
call fcn.7cf72f14
cmp dword [ebp + 8], 0x1a
jne 0x7cf72e00
and dword [0x7d04c770], 0
jmp 0x7cf72e03
or dword [edi], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x7cf72e12
push ebx
call sym.SHELL32.dll_ILFree
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7cf7307b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
push eax
push esi
push esi
push 0x7cf3218c
push dword [0x7d04c778]
mov dword [ebp - 8], 1
mov dword [ebp - 4], ebx
call edi
cmp dword [ebp - 8], esi
mov eax, dword [ebp + 8]
je 0x7cf730c0
mov ecx, dword [0x7d04c778]
jmp 0x7cf730ca
mov ecx, dword [eax*4 + 0x7d04c708]
mov ecx, dword [ecx + 0x10]
lea esi, [eax*4 + 0x7d04c708]
lea eax, [ebp - 4]
push eax
mov dword [ebp + 8], ecx
mov eax, dword [esi]
mov dword [ebp - 4], ebx
add eax, 0x1c
push eax
push 0
push 0
push 0x7cf3217c
push ecx
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
mov eax, dword [esi]
add eax, 0x30
xor ebx, ebx
push eax
push ebx
push ebx
push 0x7cf32160
push dword [ebp + 8]
call edi
mov ecx, dword [esi]
push ebx
push 0x64
mov eax, dword [ecx + 0x1c]
push dword [ecx + 0x2c]
cdq
push dword [ecx + 0x28]
mov edi, eax
mov dword [ebp + 8], edi
mov edi, edx
call fcn.7d041a10
push edx
push eax
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.7d0419d0
test edx, edx
ja 0x7cf7313f
jb 0x7cf7313a
cmp eax, 0xffffffff
jae 0x7cf7313f
mov dword [ebp - 0xc], edx
jmp 0x7cf73146
or eax, 0xffffffff
and dword [ebp - 0xc], 0
mov ecx, dword [esi]
mov dword [ecx + 0x20], eax
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_223]
mov ecx, dword [esi]
push 1
mov dword [ecx + 0xc], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7cf73165
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f54
call fcn.7d041c90
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
push 1
push esi
call fcn.7cf747ae
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
je 0x7cf73286
lea eax, [ebp - 0x1f54]
push 1
mov dword [ebp - 4], eax
mov eax, dword [esi*4 + 0x7d04c708]
push edi
mov dword [ebp - 8], edi
mov esi, dword [eax + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
neg esi
sbb esi, esi
and esi, 0x208
add esi, 0x118
call edi
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1f54]
push esi
push 1
push eax
push ebx
call fcn.7cf7453c
test eax, eax
je 0x7cf73253
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xa
jne 0x7cf73242
xor eax, eax
push 1
push eax
push eax
push ebx
mov dword [ebp - 8], eax
call edi
push 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push ebx
call edi
lea ebx, [esi + esi*4]
lea eax, [ebp - 0x14]
push 0
push eax
shl ebx, 1
lea eax, [ebp - 0x1f54]
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x7cf73250
cmp dword [ebp - 0x14], ebx
jne 0x7cf73250
add dword [ebp - 0x10], ebx
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 0xc]
call edi
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x1f54]
mov dword [ebp - 4], eax
jmp 0x7cf73245
add dword [ebp - 4], esi
push dword [ebp + 8]
push esi
push 1
push dword [ebp - 4]
jmp 0x7cf731d4
mov ebx, dword [ebp - 0xc]
push 0
push 0
push dword [ebp - 0x10]
push ebx
call edi
imul esi, dword [ebp - 8]
lea eax, [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0x1f54]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp + 8]
push ebx
call fcn.7cf74762
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x7cf7328f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push fcn.7cf73165
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x7cf732b8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7cf732c0
push dword [ebp + 8]
call fcn.7cf73165
leave
ret 4
Function at 0x7cf73a04
Capabilities:
Get disk information
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
xor edi, edi
cmp eax, 0x1a
jne 0x7cf73a5c
mov eax, dword [0x7d04c770]
mov ebx, dword [eax + 0x14]
lea eax, [ebp - 0x20c]
push eax
push 0x1a
call fcn.7cf71c3a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x7cf32208
push ebx
call esi
jmp 0x7cf73a66
mov eax, dword [eax*4 + 0x7d04c708]
mov ebx, dword [eax + 0x10]
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call fcn.7cf71c16
push edi
push edi
push edi
lea eax, [ebp - 4]
push edi
push eax
push edi
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x7cf73aa1
lea eax, [ebp - 4]
push 4
push eax
push 4
push edi
push 0x7cf32214
push ebx
call esi
mov eax, dword [ebp + 8]
push 4
mov eax, dword [eax*4 + 0x7d04c708]
add eax, 0x18
push eax
push 4
push edi
push 0x7cf321f4
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7cf73ac3
Capabilities:
Set registry value

Disassembly:
push esi
push edi
push 4
lea eax, [esp + 0x18]
pop edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push eax
push edi
push 0
push 0x7cf3217c
push dword [0x7d04c778]
call esi
test eax, eax
jne 0x7cf73b32
lea eax, [esp + 0x10]
push edi
push eax
push edi
push 0
push 0x7cf32160
push dword [0x7d04c778]
call esi
test eax, eax
jne 0x7cf73b32
lea eax, [esp + 0xc]
push edi
push eax
push edi
push 0
push 0x7cf3218c
push dword [0x7d04c778]
call esi
test eax, eax
jne 0x7cf73b32
push dword [0x7d04b030]
call dword [sym.imp.SHLWAPI.dll_Ordinal_224]
push 1
mov dword [0x7d04c774], eax
pop eax
jmp 0x7cf73b34
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x7cf73bf3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xce8
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test esi, esi
push edi
je 0x7cf73c0d
and dword [esi], ebx
and dword [esi + 4], ebx
push dword [ebp + 8]
call fcn.7cf720df
test eax, eax
je 0x7cf73c5d
lea eax, [ebp - 0x660]
push eax
push dword [ebp + 8]
call fcn.7cf71c3a
lea eax, [ebp - 0x660]
push 0x7cf320ac
push eax
lea eax, [ebp - 0xce8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0xce8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x7cf73c64
xor eax, eax
jmp 0x7cf73d4a
lea eax, [ebp - 0x224]
push eax
call fcn.7cf72b87
test eax, eax
jne 0x7cf73d27
lea eax, [ebp - 0x224]
push 0x7cf334d0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7cf73d27
inc ebx
test esi, esi
je 0x7cf73d1c
test byte [ebp - 0x250], 0x10
je 0x7cf73d0b
mov ecx, 0x11e
xor eax, eax
lea edi, [ebp - 0xad8]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x660]
mov dword [ebp - 0xae0], 1
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.7cfdb9e4
mov eax, dword [ebp - 0xad8]
mov ecx, dword [ebp - 0xad4]
jmp 0x7cf73d17
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x234]
add dword [esi], eax
adc dword [esi + 4], ecx
cmp dword [ebp + 0x10], 0
je 0x7cf73d27
cmp ebx, dword [ebp + 0x10]
jg 0x7cf73d3f
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7cf73c64
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x7cf7431f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7cf74348
test al, 0x10
je 0x7cf7433f
push edi
call fcn.7cf7424d
jmp 0x7cf74346
push eax
push edi
call fcn.7cf7422d
mov esi, eax
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x7cf7453c
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7cf746d5
mov ebx, dword [ebp + 0x18]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0xc], eax
jne 0x7cf746d5
cmp dword [ebp + 0x10], 0
je 0x7cf7458a
cmp byte [esi], 0
je 0x7cf746ba
cmp eax, 0x320
lea eax, [ebp - 0x618]
push 0x104
push eax
jne 0x7cf745ac
lea eax, [esi + 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
jmp 0x7cf745b3
push esi
call dword [sym.imp.SHLWAPI.dll_SHAnsiToUnicode]
cmp dword [esi + 0x108], ebx
lea eax, [ebp - 0x208]
push eax
push ebx
je 0x7cf74663
call fcn.7cf71c3a
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push dword [esi + 0x104]
push dword [esi + 0x108]
push eax
call fcn.7cf732c4
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call edi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push dword [esi + 0x104]
push ebx
push eax
call fcn.7cf732c4
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
push eax
call edi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.7cf9cee3
test eax, eax
jne 0x7cf746de
jmp 0x7cf746a8
call fcn.7cf71c3a
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push dword [esi + 0x104]
push dword [esi + 0x108]
push eax
call fcn.7cf732c4
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call edi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x7cf74701
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.7cf74706
cmp dword [ebp + 0x10], 0
je 0x7cf74701
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x7cf7456f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
mov al, bl
mov dword [esi + 0x108], ebx
add al, 0x41
mov byte [esi], al
mov eax, dword [ebx*4 + 0x7d04c708]
cmp dword [eax + 0x18], 0
je 0x7cf74701
add ebx, 0x41
mov word [esi + 0x118], bx
push 1
pop eax
jmp 0x7cf746d7
Function at 0x7cf74706
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
xor ebx, ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
call esi
mov edi, dword [ebp + 0x10]
lea ecx, [edi + 0x14]
cmp eax, ecx
jb 0x7cf7475b
sub eax, edi
push ebx
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp + 0x10], eax
call esi
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ebx
push ecx
push edi
push eax
push dword [ebp + 8]
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x7cf7475b
mov eax, dword [ebp + 0x10]
push ebx
add eax, edi
push ebx
push eax
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x7cf748be
Capabilities:
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x744
push ebx
mov ebx, dword [ebp + 0x14]
and dword [ebp - 4], 0
push esi
mov eax, dword [ebx*4 + 0x7d04c708]
push edi
lea edi, [ebx*4 + 0x7d04c708]
cmp dword [eax + 0x18], 0
je 0x7cf748f5
push dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, 0x104
lea eax, [ebp - 0x334]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_365]
test eax, eax
jne 0x7cf74920
lea eax, [ebp - 0x334]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToAnsi]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], eax
mov eax, dword [edi]
xor edx, edx
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp + 0x18]
lea eax, [eax + ecx - 1]
div ecx
imul eax, ecx
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 1
push ebx
call fcn.7cf747ae
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x7cf749c7
mov ecx, dword [edi]
push 2
push 0
push 0
mov esi, dword [ecx + 0x18]
push eax
neg esi
sbb esi, esi
and esi, 0x208
add esi, 0x118
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0x14]
push 0
push eax
lea eax, [ebp - 0x334]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x7cf749be
cmp esi, dword [ebp + 0x14]
jne 0x7cf749be
mov dword [ebp - 4], 1
push ebx
push dword [ebp + 0xc]
call fcn.7cf74762
cmp dword [ebp - 4], 0
jne 0x7cf74a0f
lea eax, [ebp - 0x53c]
push eax
push ebx
call fcn.7cf71c3a
push dword [ebp + 8]
lea eax, [ebp - 0x744]
push dword [ebp + 0x10]
push ebx
push eax
call fcn.7cf732c4
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x53c]
push eax
call fcn.7cf7431f
jmp 0x7cf74a30
lea eax, [ebp + 8]
push 4
push eax
mov eax, dword [edi]
push 4
push 0
push 0x7cf322a4
mov dword [ebp + 8], 1
push dword [eax + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7cf74b40
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
lea eax, [ebp - 0x208]
push edi
push eax
push dword [ebp + 8]
xor esi, esi
call fcn.7cf71c3a
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call fcn.7cf71bf3
lea eax, [ebp - 0x208]
push eax
call sym.SHELL32.dll_Ordinal_159
cmp eax, esi
jne 0x7cf74bac
push dword [ebp + 8]
call fcn.7cfdb87b
test eax, eax
je 0x7cf74b95
lea eax, [ebp - 0x208]
push eax
call fcn.7cf74ac6
jmp 0x7cf74ba8
lea eax, [ebp - 0x208]
push esi
push eax
push esi
call sym.SHELL32.dll_SHCreateDirectoryExW
neg eax
sbb eax, eax
inc eax
cmp eax, esi
je 0x7cf74c29
lea eax, [ebp - 0x208]
push 0x7cf334d0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
push 0x7cf322bc
push 0x7cf334e8
push 0x7cf35400
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push 6
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x208]
push eax
call edi
lea eax, [ebp - 0x208]
push 6
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call edi
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7cf74bfa
push 1
pop esi
mov eax, esi
pop edi
pop esi
leave
ret 4

Function at 0x7cf74d27
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
push 4
mov dword [ebp - 4], edi
pop ebx
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 4]
call fcn.7cf71c99
lea eax, [ebp - 8]
push eax
push 3
lea eax, [ebp - 0x21c]
push edi
push eax
push dword [0x7d04c77c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cf74e05
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 0x7cf3230c
push dword [ebp - 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x7cf74da7
cmp dword [ebp - 0x14], 1
jne 0x7cf74da7
push 0x7cf3230c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x7cf322a4
push dword [ebp - 8]
call esi
test eax, eax
jne 0x7cf74dd6
cmp dword [ebp - 0x10], 1
jne 0x7cf74dd6
push 0x7cf322a4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call fcn.7cf74c31
test eax, eax
je 0x7cf74dfc
cmp dword [ebp - 0x14], edi
je 0x7cf74def
push dword [ebp - 4]
call fcn.7cf7328f
cmp dword [ebp - 0x10], edi
je 0x7cf74dfc
push dword [ebp - 4]
call fcn.7cf7434f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1b
jl 0x7cf74d41
call sym.SHELL32.dll_SHUpdateRecycleBinIcon
push edi
push edi
push 0x3000
push edi
call sym.SHELL32.dll_SHChangeNotify
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7cf758ef
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor eax, eax
push edi
mov dword [esp + 0x10], eax
cmp dword [esi], eax
mov dword [esp + 0x14], eax
jne 0x7cf75932
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call edi
push ebx
mov ebp, eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi], 1
sub ecx, eax
lea eax, [ebp + ecx + 0xa]
mov dword [esi + 8], eax
lea edi, [esi + 0x220]
push 0x7cf333a8
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x7cf75ab7
lea eax, [esi + 0x428]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [esp + 0x20], 0xffffffff
je 0x7cf75aa1
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ebx, 0x104
lea eax, [esi + 0x454]
push eax
call fcn.7cf72b87
test eax, eax
jne 0x7cf75a4c
lea eax, [esi + 0x454]
mov dword [esp + 0x14], 1
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x7cf759d6
cmp word [esi + 0x65c], 0
lea eax, [esi + 0x65c]
je 0x7cf759c6
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x7cf759d6
push ebx
lea eax, [esi + 0x18]
push edi
push eax
mov dword [esp + 0x1c], 0xce
call ebp
cmp dword [esp + 0x10], 0
jne 0x7cf75a45
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi + 8]
lea eax, [eax + ecx + 1]
cmp eax, ebx
jle 0x7cf75a01
push ebx
lea eax, [esi + 0x18]
push edi
push eax
mov dword [esp + 0x1c], 0xce
call ebp
jmp 0x7cf75a45
test byte [esi + 0x428], 0x10
je 0x7cf75a17
push esi
push edi
call fcn.7cf758ef
mov dword [esp + 0x10], eax
jmp 0x7cf75a45
push edi
call fcn.7cf755ba
test eax, eax
jne 0x7cf75a33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
push ebx
lea eax, [esi + 0x18]
push edi
push eax
call ebp
mov eax, dword [esi + 0x448]
mov ecx, dword [esi + 0x444]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [esp + 0x10], 0
jne 0x7cf75a6c
lea eax, [esi + 0x428]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7cf7597c
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
jne 0x7cf75acf
push dword [esp + 0x1c]
call fcn.7cf7525a
test eax, eax
jne 0x7cf75acf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
add esi, 0x18
push dword [esp + 0x20]
mov dword [esp + 0x18], eax
push esi
call ebp
jmp 0x7cf75acf
push ebx
call fcn.7cf7525a
test eax, eax
jne 0x7cf75acf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
jmp 0x7cf75abf
mov dword [esp + 0x10], 0xce
push 0x104
add esi, 0x18
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8
Function at 0x7cf77f13
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0xc], ebx
mov dword [ebp - 0x14], ebx
jne 0x7cf78034
push ebx
push ebx
call dword [sym.imp.COMCTL32.dll_DPA_CreateEx]
cmp eax, ebx
mov dword [edi + 0xc], eax
je 0x7cf78034
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 8], 0x7d04c708
push dword [ebp + 8]
call fcn.7cf74c31
test eax, eax
je 0x7cf78020
push ebx
push 1
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.7cf747ae
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x7cf78020
mov ecx, dword [ebp - 8]
push dword [ebp + 8]
mov ecx, dword [ecx]
mov esi, dword [ecx + 0x18]
lea ecx, [ebp - 0x334]
neg esi
sbb esi, esi
and esi, 0x208
add esi, 0x118
push esi
push ebx
push ecx
push eax
call fcn.7cf7453c
test eax, eax
je 0x7cf77fec
xor eax, eax
cmp byte [ebp - 0x334], bl
jne 0x7cf77fb7
inc dword [ebp - 4]
jmp 0x7cf77fc6
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call fcn.7cf77c56
cmp eax, ebx
je 0x7cf77fdb
mov ecx, dword [ebp - 0xc]
inc dword [ebp - 0xc]
push eax
push ecx
push dword [edi + 0xc]
call dword [sym.imp.COMCTL32.dll_DPA_SetPtr]
push dword [ebp + 8]
lea eax, [ebp - 0x334]
push esi
push ebx
push eax
push dword [ebp - 0x10]
jmp 0x7cf77f9f
cmp dword [ebp - 4], 0x64
jle 0x7cf78015
lea eax, [ebp - 4]
push 4
push eax
mov eax, dword [ebp - 8]
push 4
push ebx
mov eax, dword [eax]
push 0x7cf3230c
mov dword [ebp - 4], 1
push dword [eax + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.7cf74762
add dword [ebp - 8], 4
inc dword [ebp + 8]
cmp dword [ebp - 8], 0x7d04c774
jl 0x7cf77f50
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x7cf7806f
push dword [edi + 0x10]
push eax
call dword [sym.imp.COMCTL32.dll_DPA_GetPtr]
cmp eax, ebx
mov dword [ebp - 0x14], eax
push ebx
je 0x7cf7805b
push dword [edi + 0x10]
push dword [edi + 0xc]
call dword [sym.imp.COMCTL32.dll_DPA_SetPtr]
jmp 0x7cf7806c
push 0x7cf64229
push dword [edi + 0xc]
call dword [sym.imp.COMCTL32.dll_DPA_DestroyCallback]
mov dword [edi + 0xc], ebx
inc dword [edi + 0x10]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 4