joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431d50
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x496534]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movq xmm0, qword [str.Canon]
mov eax, dword [0x485fdc]
mov esi, dword [ebp + 8]
movq qword [ebp - 0x64], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x6c]
movq qword [ebp - 0x48], xmm0
movups xmm0, xmmword [str.V4Installer]
push eax
push 8
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x6c], 0
movq xmm0, qword [0x48a508]
movq qword [ebp - 0x2c], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0x104
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x431e09
push 0x493240
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x80004005
push eax
call fcn.0044f8e6
lea eax, [ebp - 0x74]
push eax
push esi
push dword [ebp - 0x6c]
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x431e42
push 0x493240
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x80004005
push eax
call fcn.0044f8e6
mov dword [ebp - 0x68], 0
mov eax, 0x431e3d
ret
lea edi, [ebp - 0x64]
mov dword [ebp - 0x68], 2
nop dword [eax]
push edi
push esi
push 0x485f30
push 0x104
push esi
call fcn.004305f0
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add edi, 0x28
sub dword [ebp - 0x68], 1
jne 0x431e50
mov esi, 1
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x431e8a
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ae75
mov esp, ebp
pop ebp
ret 8

Function at 0x436f67
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x436fac
call fcn.004350f7
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x436fac
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x436fc8
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00432aaa
mov ebx, eax
test edi, edi
je 0x436fc6
test esi, esi
je 0x436fc6
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4375ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4376aa
cmp dword [esi + 0x20], 0
je 0x4376aa
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4376aa
cmp dword [ebp + 8], 0
je 0x4376aa
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004350f7
push 0x478698
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x43767b
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4376aa
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00443dfe
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x43769b
test edi, edi
je 0x43769b
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x4376a6
mov ecx, esi
call fcn.004373cb
mov eax, ebx
jmp 0x4376ac
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4409c8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x473511
call fcn.0044b700
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x440a72
push dword [ebp + 8]
mov ecx, eax
call fcn.00440d00
mov esi, eax
test esi, esi
je 0x440b05
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x440a5b
push edx
call fcn.00433269
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440a5b
xor edi, edi
inc edi
jmp 0x440a65
push dword [ebx]
call fcn.00433272
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00424600
jmp 0x440b03
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.0044b6c3
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x440afb
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.00433269
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x440af5
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405800
push edi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.00405800
add al, bl
mov edx, edi
test edx, edx
jns 0x440ae6
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x440abd
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00401bc0
mov eax, edi
call fcn.0044b6c9
ret 0x10

Function at 0x440b0d
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x440b60
push esi
push dword [ebp + 8]
call fcn.00440d00
mov edi, eax
test edi, edi
jne 0x440b30
mov eax, dword [ebp + 0x10]
jmp 0x440b72
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x440b2b
mov eax, dword [ebp - 8]
jmp 0x440b72
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x465408
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004650c8
Function at 0x4f67e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4f6805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4f6878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4f683a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x4f686d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4f686b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x4f6831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4f67fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
invalid
inc ebp

Function at 0x401910
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4018fd
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40191b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [ebp + 0xf8c784], cl
add byte [eax], al
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x401979
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
adc byte [eax], al
add byte [eax], al
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401960
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401969
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401973
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401955
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4018df
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x401ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00401236
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004011eb
add esp, 0xc
mov dword [ebp - 0x68c], eax

Function at 0x401ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
stc
invalid
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
invalid
inc dword [eax]
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
invalid
dec dword [ebx]
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00401236
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
sbb dh, dh
invalid

Function at 0x402030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ebx - 0x7a76efbb]
inc esp
stc
invalid
Function at 0x4025f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx - 0x6cb43]
inc dword [eax]
je 0x4033b9
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00401197
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x402633
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40267c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x402626
call fcn.00401226
mov ah, 0x67
clc
arpl word [eax - 0x72b5b], ax
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00401226
lodsd eax, dword [esi]
test al, 0x6f
jp 0x4026a1
test esp, edx
clc
invalid
Function at 0x7cf4d47f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
sub eax, edi
je 0x7cf4d5ed
mov ebx, dword [ebp + 8]
dec eax
dec eax
je 0x7cf4d5c0
dec eax
je 0x7cf4d59a
dec eax
je 0x7cf4d4b6
dec eax
jne 0x7cf4d5e4
jmp 0x7cf4d62b
lea eax, [ebp + 8]
push eax
push 0x20019
push edi
push 0x7cf45238
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cf4d62b
lea eax, [ebp + 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
mov edi, 0x7cf4521c
mov dword [ebp + 0xc], 8
push edi
push dword [ebp + 8]
call esi
push dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x2001f
push 1
push 0x7cf32b54
push 0
push 0x7cf45188
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7cf4d62b
cmp dword [ebp - 4], 1
je 0x7cf4d578
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 8
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x7cf4d578
push 8
lea edi, [ebp - 0x18]
pop ecx
lea esi, [ebp - 0x10]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x7cf4d578
push dword [ebp + 8]
call ebx
xor eax, eax
jmp 0x7cf4d62e
lea eax, [ebp - 0x10]
push 8
push eax
push 3
push 0
push 0x7cf45200
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call ebx
jmp 0x7cf4d62b
cmp dword [0x7d04e928], edi
mov esi, dword [sym.imp.USER32.dll_SetTaskmanWindow]
je 0x7cf4d5b1
push edi
call esi
mov dword [0x7d04e928], edi
push ebx
call esi
cmp eax, edi
je 0x7cf4d5e4
mov dword [0x7d04e928], ebx
jmp 0x7cf4d5e4
cmp dword [0x7d04e924], edi
mov esi, dword [sym.imp.USER32.dll_SetProgmanWindow]
je 0x7cf4d5d7
push edi
call esi
mov dword [0x7d04e924], edi
push ebx
call esi
cmp eax, edi
je 0x7cf4d5e4
mov dword [0x7d04e924], ebx
push ebx
call dword [sym.imp.USER32.dll_RegisterShellHookWindow]
jmp 0x7cf4d62e
call dword [sym.imp.USER32.dll_GetProgmanWindow]
mov dword [0x7d04e924], eax
call dword [sym.imp.USER32.dll_GetTaskmanWindow]
mov esi, dword [ebp + 8]
mov dword [0x7d04e928], eax
cmp esi, dword [0x7d04e924]
jne 0x7cf4d615
push edi
call dword [sym.imp.USER32.dll_SetProgmanWindow]
cmp esi, dword [0x7d04e928]
jne 0x7cf4d624
push edi
call dword [sym.imp.USER32.dll_SetTaskmanWindow]
push esi
call dword [sym.imp.USER32.dll_DeregisterShellHookWindow]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7cf4e69d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
push esi
lea eax, [ebp - 0x54]
push 0x27
push eax
mov dword [ebp - 4], 0x208
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_24]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x54]
push eax
push 0x7cf36d14
lea eax, [ebp - 0x1a4]
xor esi, esi
push 0xa7
push eax
mov word [ebx], si
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x1a4]
push esi
push eax
push ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cf4e744
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
push ebx
push esi
push esi
push esi
push dword [ebp + 8]
call edi
push esi
push esi
push esi
push esi
push 0x7cf36cf4
push dword [ebp + 8]
call edi
mov ecx, dword [ebp + 0x14]
push dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ax, word [ebx]
pop esi
neg ax
sbb eax, eax
pop ebx
and eax, 0x7ffbfeac
add eax, 0x80040154
leave
ret 0x10
Function at 0x7cf50359
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], 1
cmp edi, eax
je 0x7cf50392
mov ebx, dword [ebp + 0x18]
cmp ebx, 0x2000
jne 0x7cf5038b
push edi
call fcn.7cf6af1b
jmp 0x7cf5047f
mov esi, dword [ebp + 0x10]
cmp esi, eax
jne 0x7cf50399
xor eax, eax
jmp 0x7cf5047f
test bl, 8
mov dword [esi], eax
mov word [esi + 0xc], ax
mov word [esi + 0x214], ax
jne 0x7cf50407
test bh, 8
je 0x7cf503ca
test byte [ebp + 0xc], 0x10
je 0x7cf503bc
test byte [ebp + 0xc], 5
jne 0x7cf503c7
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x7cf503ca
and ebx, 0xffffffef
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x7cf50407
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x20c]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
mov dword [ebp + 8], eax
mov edi, eax
mov dword [ebp + 0x10], ebx
and dword [ebp + 0x10], 8
je 0x7cf50415
mov dword [ebp + 0x18], edi
jmp 0x7cf50450
test bl, 0x10
je 0x7cf50447
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x458]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x45c], eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x45c]
push eax
push dword [ebp + 8]
call fcn.7cfb22c3
jmp 0x7cf50450
push edi
call sym.SHELL32.dll_ILCreateFromPath
mov dword [ebp + 0x18], eax
cmp dword [ebp + 0x18], 0
je 0x7cf50478
test bh, 0x5f
je 0x7cf50468
push ebx
push esi
push dword [ebp + 0x18]
call fcn.7cf8fe79
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jne 0x7cf5047c
push dword [ebp + 0x18]
call sym.SHELL32.dll_ILFree
jmp 0x7cf5047c
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7cf50b0d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
push esi
and word [esi], 0
cmp dword [edi + 0xc], 0
je 0x7cf50bc0
push dword [ebp + 0x10]
push edi
call fcn.7cf9e17a
mov ebx, eax
test ebx, ebx
jl 0x7cf50bea
push 1
pop eax
cmp ebx, eax
jne 0x7cf50b58
test byte [edi + 0x10], 0x80
jne 0x7cf50bec
push esi
push dword [ebp + 0x10]
push edi
call fcn.7cf67beb
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
and dword [ebp + 0x14], 0x4000
jne 0x7cf50b74
push esi
push eax
push edi
push dword [ebp + 8]
call fcn.7cf9e247
mov ebx, eax
test ebx, ebx
je 0x7cf50b7c
and word [esi], 0
cmp dword [ebp + 0x14], 0
jne 0x7cf50bea
lea eax, [ebp + 0x10]
push eax
push 0x7cf37944
push dword [ebp + 0x10]
push edi
call fcn.7cf9e0a3
test eax, eax
jl 0x7cf50bea
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push dword [edi + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7cf50bea
push dword [ebp + 0x10]
push edi
call fcn.7cf67beb
mov ebx, eax
test ebx, ebx
jne 0x7cf50be6
test byte [ebp + 0x15], 0x40
jne 0x7cf50bea
push esi
push dword [ebp + 0x14]
push edi
push dword [ebp + 8]
call fcn.7cf9e247
mov ebx, eax
jmp 0x7cf50bea
and word [esi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x7cf510a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
cmp dword [ebp + 8], eax
je 0x7cf510e8
lea ecx, [ebp - 4]
mov word [ebp - 0x2c], ax
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push eax
push eax
mov dword [ebp - 4], 0x28
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
cmp word [ebp - 0x2c], 0x30
jb 0x7cf510e8
cmp word [ebp - 0x2c], 0x39
ja 0x7cf510e8
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
jmp 0x7cf510eb
mov eax, dword [ebp + 0x10]
leave
ret 0xc
Function at 0x7cf514aa
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1c], eax
test byte [ebp + 0xd], 0x20
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
je 0x7cf514e9
mov eax, dword [0x7d04cbc8]
cmp eax, edi
je 0x7cf5162c
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
pop eax
jmp 0x7cf51641
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
test byte [ebp + 0xd], 0x10
mov dword [ebp - 0x14], eax
je 0x7cf5150b
test byte [ebp + 0xc], 1
jne 0x7cf5150b
and byte [ebp + 0xd], 0xef
cmp dword [ebp + 0x18], edi
mov dword [ebp - 0xc], edi
jle 0x7cf5163e
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x1c]
and eax, 0x8000
mov esi, ParseURLA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jne 0x7cf51590
call fcn.7cf8c805
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x7cf5162c
mov eax, dword [ebp - 0x1c]
push edi
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 8], eax
push dword [0x7d04cdfc]
push 0
push dword [ebp + 8]
push esi
push esi
push esi
push esi
push 0x60000000
push 0x7cf352bc
push 0x7cf35290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x7cf51625
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], 0x401
cmp dword [ebp - 0x14], 0
je 0x7cf515f3
push dword [ebp - 8]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
push 1
call fcn.7cf51850
mov edi, eax
test edi, edi
je 0x7cf5160a
push dword [ebp - 8]
push edi
push 0x411
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_SHLockShared]
test eax, eax
je 0x7cf515e7
mov ecx, dword [eax + 4]
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.SHLWAPI.dll_SHUnlockShared]
push dword [ebp - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_SHFreeShared]
jmp 0x7cf5160a
push ebx
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7cf51648
mov dword [ebp - 4], eax
xor edi, edi
cmp dword [ebp - 4], edi
je 0x7cf51630
inc dword [ebp - 0xc]
add ebx, 8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x18]
jl 0x7cf5152a
jmp 0x7cf5163e
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x7cf51641
cmp dword [ebp - 0x10], edi
je 0x7cf5163e
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x18