joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cddbb84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x7ce4f11c], esi
jne 0x7cddbc74
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push ebx
push eax
push 1
mov ebx, 0x7cd74e84
push esi
push ebx
push 0x80000001
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x7cddbc03
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push 0x7ce4f118
push eax
push esi
push 0x7cd74e68
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7cddbbf4
cmp dword [ebp - 0xc], 4
jne 0x7cddbbf4
cmp dword [ebp - 4], esi
jne 0x7cddbbfa
mov dword [0x7ce4f118], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x7ce4f118], esi
jne 0x7cddbc68
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
push eax
push 1
push esi
push ebx
push 0x80000002
call edi
test eax, eax
jne 0x7cddbc68
push 4
lea eax, [ebp - 4]
pop edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x7cd74e68
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7cddbc50
cmp dword [ebp - 0xc], edi
jne 0x7cddbc50
cmp dword [ebp - 4], esi
jne 0x7cddbc53
mov dword [ebp - 0x10], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x7cddbc68
mov dword [0x7ce4f118], eax
pop ebx
mov dword [0x7ce4f11c], 1
pop edi
mov eax, dword [0x7ce4f118]
pop esi
leave
ret

Function at 0x7cde010e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jbe 0x7cde012e
movzx ecx, word [esi]
shl edi, 8
xor edi, ecx
inc esi
inc esi
dec eax
jne 0x7cde0121
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x7cde4606
Capabilities:
Check for time delay via gettickcount
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x20], 0
je 0x7cde462e
call ebx
sub eax, dword [esi + 0x1c]
cmp eax, 0x64
jbe 0x7cde4766
mov edi, 0x7ce4f6f0
mov ecx, edi
call fcn.7ce2d132
call ebx
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x18]
sub eax, 0
je 0x7cde464f
dec eax
je 0x7cde4691
jmp 0x7cde475f
lea eax, [ebp - 0x134]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x7cde4691
lea eax, [ebp + eax - 0x134]
push 0x7cd75370
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x7cde4691
mov dword [esi + 0x18], 1
cmp dword [esi + 0x18], 1
jne 0x7cde475f
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.7ce2d7a8
push 0x7cd75360
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x7cde46cd
push 0x7cd7549c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push 0
push eax
mov ecx, edi
call fcn.7ce2d840
cmp dword [esi + 0x18], 1
je 0x7cde4705
test ebx, ebx
je 0x7cde4705
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.7ce2d7a8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x18]
push 0
push eax
mov ecx, edi
call fcn.7ce2d840
jmp 0x7cde475f
cmp dword [ebp - 4], 0
je 0x7cde4726
lea ebx, [esi + 0x14]
push ebx
push 0x7cd75228
call dword [ebp - 4]
test eax, eax
jl 0x7cde4723
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
jmp 0x7cde4726
and dword [ebx], 0
xor eax, eax
cmp dword [ebp - 4], eax
je 0x7cde4732
cmp dword [esi + 0x14], eax
jne 0x7cde4758
cmp dword [ebp - 8], eax
je 0x7cde4758
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.7ce2d7a8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x18]
push 0
push eax
mov ecx, edi
call fcn.7ce2d840
mov dword [esi + 0x18], 2
mov ecx, edi
call fcn.7ce2d33d
mov dword [esi + 0x20], 1
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x7cde5329
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [eax], edi
jne 0x7cde534c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x58]
cmp eax, 0x64
jb 0x7cde537f
cmp dword [esi + 0x3c], edi
jle 0x7cde5376
lea ebx, [esi + 0x40]
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.7cde7d8b
cmp dword [ebp + 0xc], 0
je 0x7cde536d
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
inc edi
add ebx, 8
cmp edi, dword [esi + 0x3c]
jl 0x7cde5354
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x58], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x7cde5b10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7e0
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
push esi
cmp dword [ebp + 0xc], ebx
push edi
mov dword [eax], ebx
je 0x7cde5b3e
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebx
je 0x7cde5b44
jmp 0x7cde5b7d
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x3e8
push eax
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0xc], ebx
mov esi, eax
je 0x7cde5b77
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x7cde5b87
mov eax, esi
or eax, 0x80070000
jmp 0x7cde5c89
cmp dword [ebp + 8], ebx
push 1
pop edi
jne 0x7cde5b99
xor eax, eax
mov dword [ebp + 8], edi
mov dword [ebp - 4], eax
jmp 0x7cde5b9c
mov eax, dword [ebp - 4]
push 2
pop ebx
shr eax, 1
cmp dword [ebp + 8], ebx
jne 0x7cde5bde
and word [ebp + eax*2 - 0x3f4], 0
mov esi, 0x1f4
lea eax, [ebp - 0x7e0]
push esi
push eax
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
cmp eax, edx
je 0x7cde5bf6
cmp eax, esi
ja 0x7cde5bf6
mov dword [ebp + 8], edi
lea esi, [ebp - 0x7e0]
jmp 0x7cde5be6
lea esi, [ebp - 0x3f4]
xor edx, edx
cmp dword [ebp + 8], edi
je 0x7cde5c00
cmp dword [ebp + 8], 7
jne 0x7cde5bf6
cmp dword [ebp + 0x14], edx
jne 0x7cde5c00
mov eax, 0x80040153
jmp 0x7cde5c89
cmp eax, edi
jb 0x7cde5c14
lea ecx, [esi + eax*2]
cmp word [ecx - 2], dx
jne 0x7cde5c14
dec eax
sub ecx, ebx
cmp eax, edi
jae 0x7cde5c07
cmp dword [ebp + 0x14], edx
jne 0x7cde5c3d
cmp eax, edi
jb 0x7cde5c3d
lea ecx, [esi + eax*2]
cmp word [ecx - 2], 0x20
jne 0x7cde5c2e
dec eax
sub ecx, ebx
cmp eax, edi
jae 0x7cde5c20
cmp eax, edi
jb 0x7cde5c3d
cmp word [esi], 0x20
jne 0x7cde5c3d
dec eax
add esi, ebx
jmp 0x7cde5c2e
cmp eax, edx
jne 0x7cde5c4c
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x7ce4f774
jmp 0x7cde5c87
cmp dword [ebp + 0x14], edx
mov word [esi + eax*2], dx
je 0x7cde5c5a
inc eax
mov word [esi + eax*2], dx
inc eax
lea edi, [eax + eax]
push edi
call fcn.7cd8702d
test eax, eax
pop ecx
jne 0x7cde5c70
mov eax, 0x8007000e
jmp 0x7cde5c89
mov ecx, edi
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7cde5c90
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x7cde5cb8
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x7cde5cbe
jmp 0x7cde5cf8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea esi, [eax + eax]
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push ebx
push eax
push 0
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0xc], 0
mov edi, eax
je 0x7cde5cf2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x7cde5d02
mov eax, edi
or eax, 0x80070000
jmp 0x7cde5e13
cmp dword [ebp + 8], 0
jne 0x7cde5d16
xor eax, eax
mov dword [ebp + 8], 1
mov dword [ebp - 4], eax
jmp 0x7cde5d19
mov eax, dword [ebp - 4]
shr eax, 1
cmp dword [ebp + 8], 2
jne 0x7cde5d69
and word [ebx + eax*2], 0
mov edi, 0x1f4
lea eax, [ebp - 0x3f4]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x7cde5d7e
cmp eax, edi
ja 0x7cde5d7e
lea ecx, [eax + eax + 2]
mov dword [ebp + 8], 1
cmp esi, ecx
jae 0x7cde5d53
mov ecx, esi
mov edx, ecx
lea esi, [ebp - 0x3f4]
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
pop edx
cmp dword [ebp + 8], edx
je 0x7cde5d88
cmp dword [ebp + 8], 7
jne 0x7cde5d7e
xor esi, esi
cmp dword [ebp + 0x14], esi
jne 0x7cde5d8a
mov eax, 0x80040153
jmp 0x7cde5e13
xor esi, esi
cmp eax, edx
jb 0x7cde5d9e
lea ecx, [ebx + eax*2]
cmp word [ecx - 2], si
jne 0x7cde5d9e
dec eax
dec ecx
dec ecx
cmp eax, edx
jae 0x7cde5d91
cmp dword [ebp + 0x14], esi
jne 0x7cde5e08
cmp eax, edx
jb 0x7cde5dda
lea ecx, [ebx + eax*2]
cmp word [ecx - 2], 0x20
jne 0x7cde5db8
dec eax
dec ecx
dec ecx
cmp eax, edx
jae 0x7cde5daa
cmp eax, edx
jb 0x7cde5dda
cmp word [ebx], 0x20
jne 0x7cde5dda
dec eax
je 0x7cde5dd5
mov ecx, eax
lea esi, [ebx + 2]
mov edi, ebx
shr ecx, 1
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
cmp eax, 1
jae 0x7cde5dbc
cmp eax, 2
jb 0x7cde5e01
cmp word [ebx], 0x22
jne 0x7cde5e01
cmp word [ebx + eax*2 - 2], 0x22
jne 0x7cde5e01
dec eax
dec eax
je 0x7cde5e01
mov ecx, eax
lea esi, [ebx + 2]
mov edi, ebx
shr ecx, 1
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
and word [ebx + eax*2], 0
jmp 0x7cde5e11
mov word [ebx + eax*2], si
mov word [ebx + eax*2 + 2], si
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x7cde5e1a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push ebx
push eax
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, 2
jne 0x7cde5e58
mov eax, 0x80040152
jmp 0x7cde5f45
cmp eax, ebx
je 0x7cde5e67
cmp eax, 0xea
jne 0x7cde5f40
cmp dword [ebp - 8], 3
jne 0x7cde5f40
cmp dword [ebp - 4], 2
jb 0x7cde5f40
push dword [ebp - 4]
call fcn.7cd8702d
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x7cde5e94
mov eax, 0x8007000e
jmp 0x7cde5f45
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, ebx
je 0x7cde5ebb
push esi
call fcn.7cd8701a
pop ecx
mov eax, 0x80040150
jmp 0x7cde5f45
mov ax, word [esi]
mov ecx, dword [ebp - 4]
cmp ax, 1
jne 0x7cde5f25
cmp ecx, 0x14
jb 0x7cde5f25
mov eax, dword [esi + 0x10]
and word [esi + 2], 0x7fff
cmp eax, ebx
mov dword [esi + 0xc], ebx
je 0x7cde5efb
cmp dword [ebp - 4], 0x1c
jb 0x7cde5f39
lea ecx, [eax + 8]
cmp dword [ebp - 4], ecx
jb 0x7cde5f39
add eax, esi
mov dword [esi + 0x10], eax
movzx eax, word [eax + 2]
add eax, 0x14
cmp dword [ebp - 4], eax
jb 0x7cde5f39
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x7cde5f39
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x7cde5f39
lea edx, [ecx + 0xc]
cmp dword [ebp - 4], edx
jb 0x7cde5f39
lea edx, [eax + 0xc]
cmp dword [ebp - 4], edx
jb 0x7cde5f39
add ecx, esi
add eax, esi
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
jmp 0x7cde5f30
cmp ax, 2
jne 0x7cde5f39
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
jmp 0x7cde5f45
push esi
call fcn.7cd8701a
pop ecx
mov eax, 0x80040153
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x7cde6160
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov edx, ecx
dec ecx
test edx, edx
je 0x7cde6189
push edi
lea edx, [ecx + 1]
mov ecx, dword [esp + 8]
push esi
movzx edi, byte [ecx]
mov esi, eax
shl esi, 3
xor esi, edi
xor eax, esi
inc ecx
dec edx
jne 0x7cde6177
pop esi
pop edi
ret 8
Function at 0x7cde8051
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
cmp dword [ebp + 8], 0
push esi
je 0x7cde8126
cmp dword [ebp + 0xc], 0
je 0x7cde8126
cmp dword [ebp + 0xc], 0x27
jb 0x7cde8126
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.7cde7fce
test eax, eax
jl 0x7cde812b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 7
cmp eax, esi
jbe 0x7cde80ae
mov eax, 0x8007000e
jmp 0x7cde812b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x414]
push 0x7cd736c8
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x408]
push eax
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x414]
push 0x20019
push eax
call fcn.7cde47c4
test eax, eax
jne 0x7cde811f
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push dword [ebp + 8]
push eax
push 0
push 0x7cd75fe0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x7cde811f
cmp dword [ebp + 8], 1
jne 0x7cde811f
xor eax, eax
jmp 0x7cde812b
mov eax, 0x80004005
jmp 0x7cde812b
mov eax, 0x80070057
pop esi
leave
ret 8
Function at 0x7cdebc26
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x910
push ebx
push edi
mov ebx, ecx
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
push 1
rep stosd dword es:[edi], eax
pop eax
xor edi, edi
mov word [ebp - 0x24], ax
mov dword [ebp - 0x28], eax
mov ax, word [ebx + 0x5a]
mov dword [ebp - 0x54], 0x44
cmp ax, di
mov dword [ebx + 0x9c], edi
jne 0x7cdebc66
xor eax, eax
jmp 0x7cdebdba
push esi
lea ecx, [ebp - 0x910]
push edi
mov esi, 0x104
push ecx
push esi
push edi
push eax
call fcn.7cded02c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
cmp eax, edi
je 0x7cdebc8c
cmp eax, esi
jbe 0x7cdebc9f
lea eax, [ebp - 0x910]
push esi
push eax
mov ax, word [ebx + 0x5a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
push 6
mov esi, 0x7cd804c0
pop ecx
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0x44], 1
movsw word es:[edi], word [esi]
jne 0x7cdebccf
mov ax, word [ebx + 0x5c]
push eax
call fcn.7cded02c
push eax
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebx + 0x48]
push 0x10
pop ecx
mov edi, 0x7cd82d70
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x7cdebd12
push 0x10
mov edi, 0x7cd82d50
pop ecx
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x7cdebd12
push 0x10
mov edi, 0x7cd82d60
pop ecx
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x7cdebd12
push 0x10
mov esi, eax
pop ecx
mov edi, 0x7cd82cd0
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x7cdebd18
mov word [ebp - 0x24], 7
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x910]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.7cdbb309
test eax, eax
je 0x7cdebd5e
call fcn.7cdb951f
test eax, eax
je 0x7cdebd5e
mov eax, dword [0x7ce4e0ec]
push dword [ebp - 0x24]
lea edx, [ebp - 0x910]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
jmp 0x7cdebda0
lea eax, [ebp - 0x10]
xor esi, esi
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x910]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
cmp edi, esi
je 0x7cdebda0
push 0x7530
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
test edi, edi
je 0x7cdebdb7
push 1
mov ecx, ebx
pop esi
push esi
push 0
call fcn.7cdec78b
mov dword [ebx + 0x9c], esi
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x7cded16c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
cmp word [ebp + 8], 0
mov dword [ebp - 4], 0x100
je 0x7cded1bb
lea eax, [ebp - 0x204]
push 0x200
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
test eax, eax
jne 0x7cded1a1
push 1
pop eax
jmp 0x7cded202
push 0x7cd80784
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.7cdb3197
test eax, eax
jge 0x7cded1bf
xor eax, eax
jmp 0x7cded202
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [ebp + eax*2 - 0x204], 0x30
and word [ebp + eax*2 - 0x202], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x204]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
neg eax
sbb eax, eax
neg eax
leave
ret 4

Function at 0x7cded369
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx edi, word [ebp + 0x14]
movzx ebx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push edi
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x7cded3c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x3e8
ja 0x7cded3b3
push 1
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x7cded391
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
neg eax
sbb eax, eax
neg eax
add eax, 0x80010006
jmp 0x7cded3cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7cdf1efa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
lea eax, [ebp - 0x104]
push 0x7c
push eax
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
test eax, eax
je 0x7cdf1fcd
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7cdf1f4d
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x7cdf1f45
mov dword [eax], esi
push 1
pop eax
jmp 0x7cdf1fcd
lea eax, [ebp - 8]
push eax
push esi
call sym.ole32.dll_CreateBindCtx
test eax, eax
jne 0x7cdf1f95
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sym.ole32.dll_CreateFileMoniker
test eax, eax
jne 0x7cdf1f95
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
test eax, eax
jne 0x7cdf1f95
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jne 0x7cdf1f95
push 1
pop ebx
jmp 0x7cdf1f97
xor ebx, ebx
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x7cdf1fa4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x7cdf1fb1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x7cdf1fbe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x7cdf1fcb
mov dword [eax], 1
mov eax, ebx
pop esi
pop ebx
leave
ret 8
Function at 0x7cdf60db
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push edi
push eax
push esi
call sym.ole32.dll_OleGetAutoConvert
test eax, eax
je 0x7cdf610e
lea eax, [ebp - 0x20]
push eax
push esi
call sym.ole32.dll_CoGetTreatAsClass
test eax, eax
je 0x7cdf610e
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.7cdb87f9
test eax, eax
jne 0x7cdf61be
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
call sym.ole32.dll_ProgIDFromCLSID
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cdf61c3
lea eax, [ebp + 8]
push eax
push dword [ebp - 0xc]
push 0x80000000
call ebx
push dword [ebp - 0xc]
mov esi, eax
call sym.ole32.dll_CoTaskMemFree
test esi, esi
jne 0x7cdf61c3
lea eax, [ebp - 0x10]
push eax
push 0x7cd72fb4
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x7cdf6180
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 1
jmp 0x7cdf61a8
push 0x10
mov edi, 0x7cd82d40
pop ecx
lea esi, [ebp - 0x20]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x7cdf61a8
push eax
push eax
push 1
pop esi
push esi
push 0x7cd72fb4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [ebp - 4], 0
je 0x7cdf61c3
push dword [ebp - 8]
call esi
push 1
pop eax
jmp 0x7cdf6205
lea eax, [ebp + 8]
push eax
push 0x7cd80d6c
push dword [ebp - 8]
call ebx
test eax, eax
je 0x7cdf61e7
lea eax, [ebp + 8]
push eax
push 0x7cd72f8c
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x7cdf61f2
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7cdf61f9
mov dword [ebp - 4], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7cdfa3e0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
xor edi, edi
mov dword [ebp - 4], eax
push edi
push edi
call fcn.7cd937cd
mov ebx, eax
cmp ebx, edi
jl 0x7cdfa449
movzx eax, word [0x7ce4fd98]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push eax
call fcn.7ce064ec
mov ebx, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp ebx, edi
je 0x7cdfa42e
mov esi, dword [ebp + 8]
push esi
push ebx
call fcn.7cdfa630
mov ebx, eax
jmp 0x7cdfa438
mov esi, dword [ebp + 8]
mov ebx, 0x8007000e
mov dword [esi], edi
cmp ebx, edi
jl 0x7cdfa44e
push edi
push dword [ebp - 4]
push dword [esi]
call fcn.7cdfa37a
jmp 0x7cdfa44e
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 4