joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cfb0980
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2218
call fcn.7d041c90
cmp dword [ebp + 0x10], 0
push esi
je 0x7cfb09d8
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 8]
push 4
sub eax, dword [ebp - 0x10]
pop ecx
lea eax, [eax + eax*2]
cdq
idiv ecx
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHLWAPI.dll_PathCompactPathW]
lea esi, [ebp - 0x218]
jmp 0x7cfb09db
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1218]
push 0x800
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x1218]
push esi
push eax
lea eax, [ebp - 0x2218]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2218]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop esi
leave
ret 0xc

Function at 0x7cfb0b5a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
push edi
xor edi, edi
push 0x4000004b
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sym.SHELL32.dll_SHRestricted
mov esi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
call fcn.7cf83865
test eax, eax
jne 0x7cfb0c60
cmp esi, edi
push ebx
je 0x7cfb0b9b
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x7cfb0ba9
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ebp - 0xc], 2
sete al
mov dword [ecx], eax
push 1
push reloc.SHLWAPI.dll_ParseURLA
call fcn.7cf5afcc
mov ebx, eax
cmp ebx, edi
je 0x7cfb0c57
push dword [ebp - 8]
lea eax, [ebp - 0x2b4]
mov dword [ebp + 8], 0xa0
push dword [ebp - 0xc]
push esi
push 0x7cf3c9a8
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea eax, [ebp + 8]
mov esi, 0x7cf3c990
push eax
lea eax, [ebp - 0xac]
push eax
push edi
push edi
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7cfb0c20
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
mov dword [ebp - 4], edi
je 0x7cfb0c27
mov dword [ebp - 4], 1
cmp dword [ebp - 4], edi
je 0x7cfb0c50
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2b4]
push eax
push 1
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.7cf8389f
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x7cfb1e1d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push edi
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x18], 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call sym.SHELL32.dll_Ordinal_76
test eax, eax
je 0x7cfb1eb5
push ebx
mov bl, byte [ebp + 0x10]
test bl, 2
je 0x7cfb1e58
mov eax, 0x454
jmp 0x7cfb1e80
test bl, 4
jne 0x7cfb1e6f
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x7cfb1e6f
push 0x40
pop eax
jmp 0x7cfb1e71
xor eax, eax
test bl, 8
je 0x7cfb1e79
or ah, 0x40
test bl, 1
jne 0x7cfb1e80
or al, 0x10
mov ecx, dword [ebp + 8]
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 8]
mov word [ebp - 0x28], ax
xor eax, eax
lea edi, [ebp - 0x26]
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x30], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call sym.SHELL32.dll_SHFileOperationW
push dword [ebp - 8]
call sym.SHELL32.dll_SHFree
pop ebx
pop edi
leave
ret 0xc

Function at 0x7cfb1eba
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push 1
and dword [ebp - 0x1c], 0
pop eax
or dword [ebp - 0x14], 0xffffffff
lea edx, [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push edx
lea edx, [ebp - 0x20]
mov word [ebp - 0x20], 0xf
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
jl 0x7cfb1f3b
test byte [ebp + 0xd], 4
push 0
pop eax
setne al
inc eax
or dword [ebp + 0x14], eax
test byte [ebp + 0xf], 0x10
jne 0x7cfb1f10
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x7cfb1f14
or dword [ebp + 0x14], 4
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.7cfb1e1d
lea eax, [ebp - 0xc]
push eax
call fcn.7cf53e0f
push 0
push 0
push 0x1000
push 0
call sym.SHELL32.dll_SHChangeNotify
mov eax, edi
pop edi
leave
ret 0x10

Function at 0x7cfb2191
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x7cfb21da
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x250], 0x10
jne 0x7cfb21da
cmp dword [ebp - 0x234], 0
jne 0x7cfb21da
cmp dword [ebp - 0x230], 0
jne 0x7cfb21da
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
leave
ret 4
Function at 0x7cfb21de
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push 0x7cf3ca5c
call fcn.7cfb2140
push 0x7cf3ca48
call fcn.7cfb2140
mov esi, 0x7cf3aafc
push 0x104
lea eax, [ebp - 0x208]
push dword [esi - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x208]
push eax
call fcn.7cfb2114
cmp dword [esi], 0
je 0x7cfb2233
lea eax, [ebp - 0x208]
push eax
call fcn.7cfb2191
push dword [esi + 4]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esi, 0xc
cmp esi, 0x7cf3ace8
jb 0x7cfb2201
pop esi
leave
ret

Function at 0x7cfb340f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x14]
cmp word [eax], 0x40
push dword [ebp + 0x10]
jne 0x7cfb3433
add eax, 2
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_294]
jmp 0x7cfb3442
push 0x7cf3339c
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop ebp
ret 0x14

Function at 0x7cfb3980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp + 8]
push edi
push eax
push 0x7cf33548
push dword [ebp + 8]
or edi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cfb39f0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7cfb39e7
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
push eax
lea eax, [ebp - 0x210]
push eax
call sym.SHELL32.dll_Ordinal_72
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret 4
Function at 0x7cfb8a0e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov esi, ecx
push 0x40000009
call sym.SHELL32.dll_SHRestricted
test eax, eax
jne 0x7cfb8ad0
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.7cfb8597
test eax, eax
je 0x7cfb8ad0
lea eax, [ebp - 0x20c]
push 0x7cf37f10
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsAndAttributesW]
mov edi, eax
test edi, edi
je 0x7cfb8a82
cmp dword [ebp - 4], 0xffffffff
je 0x7cfb8a82
mov eax, dword [ebp - 4]
and al, 1
neg al
sbb eax, eax
and al, 0xfd
inc eax
mov esi, eax
jmp 0x7cfb8a84
xor esi, esi
test esi, esi
jne 0x7cfb8ad3
mov eax, edi
push esi
neg eax
sbb eax, eax
push 0x80
and eax, 2
inc eax
push eax
push esi
push 1
lea eax, [ebp - 0x20c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x7cfb8ad0
push 1
pop esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x7cfb8ad3
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x7cfb8ad3
push 0xfffffffffffffffe
pop esi
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x7cfb9079
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov esi, ecx
push ebx
push 0x1042
push dword [esi + 4]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x7cfb91aa
mov ecx, dword [ebp + 8]
add eax, ecx
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x7cfb91aa
push ebx
push ebx
push 0x1004
push dword [esi + 4]
call edi
mov edx, dword [ebp + 8]
dec eax
cmp edx, eax
jg 0x7cfb91aa
push 1
mov dword [ebp - 0x28], edx
pop eax
mov ecx, 0xf000
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
push 0xd
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x40], eax
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x1bc]
push eax
push ebx
push 0x104b
mov dword [ebp - 0x4c], ebx
push dword [esi + 4]
mov dword [ebp - 0x3c], 0x50
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x50
mov dword [ebp - 0x1c], ecx
call edi
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x104b
push dword [esi + 4]
call edi
mov eax, dword [ebp - 0x50]
xor eax, dword [ebp - 0x28]
xor dword [ebp - 0x28], eax
xor eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0x104c
push dword [esi + 4]
call edi
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x104c
push dword [esi + 4]
call edi
push dword [ebp + 8]
mov dword [esi + 0x18], ebx
push ebx
push 0x1043
push dword [esi + 4]
call edi
push 3
lea eax, [ebp - 0x7c]
pop ebx
push eax
mov dword [ebp - 0x6c], ebx
push dword [ebp + 8]
mov dword [ebp - 0x70], ebx
push 0x102b
push dword [esi + 4]
call edi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x6c], ebx
push eax
mov dword [ebp - 0x70], ebx
push dword [ebp + 8]
push 0x102b
push dword [esi + 4]
call edi
jmp 0x7cfb91b2
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7cfba78f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov esi, ecx
call fcn.7cfb4a57
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xffffffffffffffff
push 0x1076
push dword [esi + 0xd4]
call ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.7cf55a72
mov eax, dword [esi]
push esi
call dword [eax + 0x34]
mov eax, dword [esi + 0x12c]
lea edi, [esi + 0x12c]
test eax, eax
je 0x7cfba7f9
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [edi], 0
push edi
mov ecx, esi
call fcn.7cfb7cc4
mov dword [esi + 0x130], eax
mov eax, dword [esi + 0x90]
lea edx, [ebp - 4]
xor edi, edi
push edx
mov dword [ebp - 4], 0x1000000
mov ecx, dword [eax]
push edi
push edi
push eax
call dword [ecx + 0x24]
push 2
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0xd4]
call ebx
cmp eax, 0xffffffff
je 0x7cfba84c
push edi
push eax
mov ecx, esi
call fcn.7cfb4aeb
push eax
push 0x2000
call fcn.7cf71116
push 1
push edi
push edi
push 1
mov ecx, esi
call fcn.7cf62d4b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7cfbcd6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
and dword [ebp - 8], 0
push ebx
push esi
mov eax, dword [ecx]
push edi
push 3
xor edx, edx
pop esi
mov dword [ebp - 4], 1
div esi
mov esi, edx
mov dword [ebp + 8], esi
push 3
lea eax, [esi + 1]
xor edx, edx
pop edi
div edi
mov eax, dword [ecx + esi*8 + 0xc]
mov edi, edx
sub eax, dword [ecx + edi*8 + 0xc]
cdq
mov ebx, eax
mov eax, dword [ecx + esi*8 + 0x10]
sub eax, dword [ecx + edi*8 + 0x10]
xor ebx, edx
sub ebx, edx
cdq
xor eax, edx
sub eax, edx
add eax, dword [ebp - 8]
add ebx, eax
mov eax, dword [ecx + esi*4 + 0x24]
sub eax, dword [ecx + edi*4 + 0x24]
mov dword [ebp - 8], ebx
mov esi, edi
cdq
xor eax, edx
sub eax, edx
add dword [ebp - 4], eax
cmp edi, dword [ebp + 8]
jne 0x7cfbcd92
mov eax, ebx
xor edx, edx
shl eax, 0xa
div dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7cfbd963
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push 1
pop ebx
and dword [esi + 0x34], 0xfffffffd
cmp dword [0x7d04ce40], 0
je 0x7cfbd9ed
push 0x10
call fcn.7cfbd8ce
mov ecx, dword [esi + 0x34]
and eax, ebx
and ecx, 0xfffffffd
shl eax, 1
or ecx, eax
mov dword [esi + 0x34], ecx
shr ecx, 1
test bl, cl
je 0x7cfbd9ed
lea eax, [ebp - 4]
push 0
push eax
push 0
push 0x26
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x7cfbd9c2
mov ecx, dword [esi + 0x34]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
and eax, ebx
and ecx, 0xfffffffd
shl eax, 1
or eax, ecx
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x34]
shr eax, 1
test bl, al
je 0x7cfbd9ed
push ebx
push 0
push 0x7cf3dd14
push 0x7cf358cc
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
mov ecx, dword [esi + 0x34]
and eax, ebx
and ecx, 0xfffffffd
shl eax, 1
or ecx, eax
mov dword [esi + 0x34], ecx
mov eax, dword [esi + 0x34]
pop esi
shr eax, 1
and eax, ebx
pop ebx
leave
ret

Function at 0x7cfbf938
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
lea eax, [ebp - 0x50]
push 0x27
push eax
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_Ordinal_24]
lea eax, [ebp + 8]
push eax
push 0x7cf3df28
push ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cfbf980
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4
Function at 0x7cfbfa00
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
lea eax, [ebp - 4]
push esi
push eax
push 0x2000000
push 0
push 0x7cf3dfe8
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cfbfa40
push 0x7cf3dfcc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call sym.SHELL32.dll_Ordinal_175
test eax, eax
je 0x7cfbfabb
lea eax, [ebp - 0x414]
push 0x104
push eax
push 0x239f
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x7cfbfabb
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea eax, [ebp - 0x20c]
push eax
push 0x7cf3df84
push 0x7cf3df78
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x7cf3df48
push 0x7cf3df38
call esi
xor eax, eax
jmp 0x7cfbfac0
mov eax, 0x80004005
pop esi
leave
ret
Function at 0x7cfbfc9d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
push 0x20019
push esi
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cfbfdbd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf003f
push esi
push 0x7cf32b54
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7cfbfdbd
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x7cfbfdbd
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push esi
call edi
cmp eax, esi
mov dword [ebp + 0x14], eax
je 0x7cfbfdbd
push ebx
push dword [ebp - 8]
push esi
call edi
mov ebx, eax
cmp ebx, esi
je 0x7cfbfdb3
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp + 0x10]
push esi
push eax
mov dword [ebp - 0xc], esi
push dword [ebp + 0x14]
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x7cfbfdac
push dword [ebp + 8]
push ebx
push dword [ebp - 0x14]
push esi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 0xc]
inc dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp + 0x10]
push esi
push eax
push dword [ebp + 0x14]
push dword [ebp - 0xc]
push dword [ebp - 4]
jmp 0x7cfbfd6a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x7cfc01b7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push 0x7cf34808
push 0x20
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
leave
ret 0xc

Function at 0x7cfc03c6
Capabilities:
Create thread
Get common file path
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
push 0x7cf3e220
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
je 0x7cfc04ad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7cf3e20c
push ebx
call esi
push 0x7cf3e1f8
push ebx
mov edi, eax
call esi
test edi, edi
mov ebx, eax
je 0x7cfc04ad
test ebx, ebx
je 0x7cfc04ad
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push 0x7cf3e1dc
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 2
call edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x210]
push 0x7cf32b54
push eax
call ebx
cmp eax, 0x652
jne 0x7cfc04a6
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x7cfc04a6
mov eax, dword [ebp - 4]
mov dword [esi + 4], edi
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x7cfc035a
push 0
push 0
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x7cfc049f
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x7cfc04a6
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push dword [ebp - 8]
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7cfc0ad5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push edi
push eax
push dword [esi + 4]
call fcn.7cf548a8
xor ebx, ebx
mov dword [ebp + 8], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
jne 0x7cfc0b33
push 0x7cf335c4
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
or dword [ebp - 0xc], 0xffffffff
push 1
pop edi
lea edx, [ebp - 0x24]
mov word [ebp - 0x18], ax
mov eax, dword [esi + 4]
push edx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x7cfc0b33
mov dword [ebp - 4], edi
cmp dword [ebp + 8], ebx
jne 0x7cfc0b41
cmp dword [ebp - 4], ebx
je 0x7cfc0c75
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
je 0x7cfc0b5e
push dword [ebp - 0x20]
call fcn.7cfa9d0a
mov edi, eax
jmp 0x7cfc0c1d
mov edi, 0x104
lea eax, [ebp - 0x434]
push edi
push eax
push ebx
push dword [ebp - 0x20]
call sym.SHELL32.dll_DragQueryFileW
lea eax, [ebp - 0x63c]
push edi
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.7d03f3d6
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push edi
push eax
lea eax, [ebp - 0x63c]
mov word [ebp - 0x22c], bx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp word [ebp - 0x22c], bx
jne 0x7cfc0bcb
lea eax, [ebp - 0x22c]
push edi
push eax
push 0x107e
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x7cfc0c17
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x434]
sub edi, eax
push ecx
push 0x7cf35104
lea eax, [ebp + eax*2 - 0x22c]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea edi, [ebp - 0x22c]
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.7cf55a23
push dword [esi + 8]
lea eax, [ebp - 0x10]
push ebx
push dword [esi + 4]
push 0x7cf39fe0
push 3
push eax
push edi
call sym.SHELL32.dll_SHOpenPropSheetW
lea eax, [ebp - 0x10]
push 3
push eax
call fcn.7cf50486
cmp dword [ebp + 8], ebx
je 0x7cfc0c6c
cmp edi, ebx
je 0x7cfc0c59
push edi
call sym.SHELL32.dll_SHFree
cmp dword [ebp + 8], ebx
je 0x7cfc0c6c
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.7cfdc265
jmp 0x7cfc0c75
lea eax, [ebp - 0x24]
push eax
call fcn.7cf53e0f
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4