joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d0105e2
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov eax, dword [esi + 0x10]
mov dword [esp + 0x10], ebx
test al, 1
je 0x7d0107a5
test ah, 0x80
jne 0x7d0107a5
cmp dword [esp + 0x1c], ebx
je 0x7d01061e
and ax, 0xfdfe
push ebx
push esi
mov dword [esi + 0x10], eax
call fcn.7d010444
jmp 0x7d0107a8
test ah, 2
jne 0x7d010628
cmp dword [esi + 0x1c], ebx
jne 0x7d01062f
xor eax, eax
jmp 0x7d0107a8
inc dword [esi + 0x18]
test al, 0x20
je 0x7d0106c3
mov eax, dword [esi + 0x250]
push 0xffffffffffffffff
lea eax, [esi + eax*2 + 0x258]
push eax
mov eax, dword [0x7d04bd68]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
jne 0x7d01079c
push 1
lea ebp, [esi + 0x48]
push ebx
push ebx
push ebp
call sym.SHELL32.dll_PifMgr_OpenProperties
mov edi, eax
cmp edi, ebx
je 0x7d01079c
and dword [esi + 0x10], 0xffffff9f
mov ecx, dword [edi + 0x10]
mov eax, dword [esi + 0x10]
and ecx, 0x60
or ecx, eax
lea eax, [edi + 0x48]
push eax
push ebp
mov dword [esi + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
pop ebp
push ebp
push dword [esi + 0x14]
push dword [esi + 0x1c]
push ebx
push edi
call sym.SHELL32.dll_PifMgr_SetProperties
cmp eax, dword [esi + 0x14]
jne 0x7d0106b7
and dword [esi + 0x10], 0xfffffffa
mov dword [esp + 0x10], ebp
push ebx
push edi
call sym.SHELL32.dll_PifMgr_CloseProperties
jmp 0x7d01079c
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, 0x80
push ebx
push edi
push 4
push ebx
lea ebp, [esi + 0x48]
push 3
push 0xc0000000
push ebp
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x40], eax
je 0x7d010721
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x7d010721
test byte [esi + 0x10], 0x80
jne 0x7d01070f
push ebx
push ebx
push ebx
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esi + 0x40], 0xffffffff
je 0x7d010721
mov eax, dword [esi + 0x10]
and ax, 0xcffb
or eax, edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x7d010792
lea ecx, [esp + 0x18]
push ebx
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x14]
push dword [esi + 0x1c]
push eax
call edi
test byte [esi + 0x10], 4
je 0x7d010753
lea eax, [esp + 0x18]
push ebx
push eax
push ebx
push dword [esi + 0x1c]
push dword [esi + 0x40]
call edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x40], 0xffffffff
and dword [esi + 0x10], 0xfffffffa
mov dword [esp + 0x10], 1
push ebx
call fcn.7d01029e
mov edi, eax
cmp edi, ebx
je 0x7d010792
lea eax, [edi + 0x48]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7d01078f
cmp edi, esi
je 0x7d01078f
or byte [edi + 0x11], 2
push edi
jmp 0x7d01076d
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
dec dword [esi + 0x18]
mov eax, dword [esp + 0x10]
jmp 0x7d0107a8
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x7d013fa2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ebx, ebx
push eax
push ebx
push reloc.SHLWAPI.dll_ParseURLA
call edi
test eax, eax
jne 0x7d014074
lea eax, [ebp - 8]
push eax
push 0x7cf456e4
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x7d013fe7
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x7d014074
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x7d014064
cmp dword [esi + 8], ebx
je 0x7d014064
cmp word [esi + 0xb8], bx
lea eax, [esi + 0xb8]
je 0x7d014064
push eax
call fcn.7d0135a2
mov ebx, eax
test ebx, ebx
je 0x7d014064
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 8]
call edi
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x7d014064
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push 0x7cf45638
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7d014055
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x7d014064
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7d01407b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
push 0
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7d014156
lea eax, [ebp - 4]
push eax
push 0x7cf456e4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x7d0140c1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7d014156
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x7d01414c
cmp word [esi + 0xb8], 0
lea eax, [esi + 0xb8]
je 0x7d01411a
push eax
call fcn.7d0135a2
mov edi, eax
test edi, edi
je 0x7d014108
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], 0
je 0x7d014120
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
jmp 0x7d014156
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
push 4
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x7cf45638
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
je 0x7d01414c
push eax
call ebx
push dword [ebp - 4]
call ebx
push dword [ebp - 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7d015b87
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 0x20019
push ebx
push 0x7cf45890
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7d015bf1
push edi
push esi
push 0x20
lea eax, [ebp + 8]
pop edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
mov dword [ebp + 8], edi
push dword [ebp + 0xc]
push ebx
push ebx
push 0x7cf458d0
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x10], ebx
je 0x7d015be6
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push dword [ebp + 0x10]
push ebx
push ebx
push 0x7cf458d8
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x7d015c3c
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x244
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
call fcn.7cf5b11e
push 1
mov dword [0x7d04f054], eax
call fcn.7cf5b11e
push edi
mov dword [0x7d04f2b8], eax
call dword [sym.imp.USER32.dll_GetDC]
push 0xd
mov esi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
add ecx, eax
mov dword [0x7d04f058], eax
mov dword [0x7d04f2c0], ecx
pop ecx
cmp eax, ecx
jg 0x7d015cae
mov dword [0x7d04f058], ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebp, 0x104
push 0x7cf44bd8
lea eax, [esp + 0x50]
push ebp
mov ebx, 0x7cf3339c
push eax
push ebx
mov edi, 0x7cf44bf0
push 0x7cf44c00
push edi
call esi
cmp word [esp + 0x4c], 0
je 0x7d015cf3
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceW]
test eax, eax
je 0x7d015cf3
call fcn.7d015c1d
push 0x7cf44bd8
lea eax, [esp + 0x50]
push ebp
push eax
push ebx
push 0x7cf44c10
push edi
call esi
cmp word [esp + 0x4c], 0
je 0x7d015d23
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceW]
test eax, eax
je 0x7d015d23
call fcn.7d015c1d
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebp, str.Lucida_Console
push 0x20
push ebp
push 0x26a1
push dword [0x7d04cdfc]
call esi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x20
push 0x7d04bcd8
push 0x26a3
push dword [0x7d04cdfc]
call edi
mov eax, dword [0x7d04df98]
mov ebx, 0x3a4
cmp eax, ebx
je 0x7d015d6d
cmp eax, 0x3b5
jne 0x7d015d95
push 0x20
push str.Courier_New
push 0x26a2
push dword [0x7d04cdfc]
call esi
push 0x20
push 0x7d04bd18
push 0x26a4
push dword [0x7d04cdfc]
call edi
push str.Courier_New
push ebp
call fcn.7d015bf6
call fcn.7d015f11
mov eax, dword [0x7d04df98]
cmp eax, ebx
je 0x7d015db9
cmp eax, 0x3b5
je 0x7d015db9
push 1
jmp 0x7d015dbb
push 2
pop eax
imul eax, eax, 0x1e0
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [0x7d04e940], eax
je 0x7d015e00
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x7d04f2d0], eax
call fcn.7d01699f
cmp dword [0x7d04f2bc], 0
jne 0x7d015e04
push dword [0x7d04e940]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x7d015e31
mov eax, dword [0x7d04df98]
push 0x14
pop ecx
cmp eax, ebx
mov dword [0x7d04f2d8], ecx
je 0x7d015e1d
cmp eax, 0x3b5
jne 0x7d015e29
add dword [0x7d04e93c], ecx
mov dword [0x7d04f2dc], ecx
call fcn.7d0175ef
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x244
ret
Function at 0x7d015f11
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push 0x7cf44cb8
call dword [sym.imp.GDI32.dll_CreateICW]
mov edi, eax
cmp edi, ebx
je 0x7d01609e
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 4
push edi
call esi
push 6
push edi
mov dword [ebp - 0xac], eax
call esi
push 8
push edi
mov dword [ebp - 0xa8], eax
call esi
push 0xa
push edi
mov dword [ebp - 0xa4], eax
call esi
push 0x58
push edi
mov dword [ebp - 0xa0], eax
call esi
push 0x5a
push edi
mov dword [ebp - 0x9c], eax
call esi
push 0x28
push edi
mov dword [ebp - 0x98], eax
call esi
push 0x2a
push edi
mov dword [ebp - 0x94], eax
call esi
push 0xc
push edi
mov dword [ebp - 0x90], eax
call esi
push edi
mov dword [ebp - 0x8c], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x88]
push 0x20
push eax
push 0xffffffffffffffff
push str.Lucida_Console
push ebx
push ebx
call edi
mov eax, dword [0x7d04df98]
mov esi, 0x3a4
cmp eax, esi
je 0x7d015fd6
cmp eax, 0x3b5
jne 0x7d015fe7
lea eax, [ebp - 0x48]
push 0x20
push eax
push 0xffffffffffffffff
push str.Courier_New
push ebx
push ebx
call edi
lea eax, [ebp - 4]
push eax
push 0x7cf45780
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x7d01609e
lea eax, [ebp - 8]
mov edi, 0x7cf457f8
push eax
lea eax, [ebp - 0x150]
push eax
push ebx
push ebx
push edi
push dword [ebp - 4]
mov dword [ebp - 8], 0xa4
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7d01604c
mov eax, 0xa4
cmp dword [ebp - 8], eax
jne 0x7d01604c
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.7d019ade
test eax, eax
je 0x7d016095
push dword [ebp - 8]
lea eax, [ebp - 0xac]
push eax
push 3
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x7cf44bd8
push ebx
push ebx
push 0x7d04bd18
call edi
mov eax, dword [0x7d04df98]
cmp eax, esi
je 0x7d016087
cmp eax, 0x3b5
jne 0x7d016095
push 0x7cf44bd8
push ebx
push ebx
push 0x7d04bcd8
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7d01699f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call edi
mov ebx, eax
push 0xf
xor ebx, 2
call edi
mov esi, eax
push 0x10
xor esi, 1
sub esi, ebx
call edi
push 0x12
sub esi, eax
call edi
push 5
add esi, eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
xor esi, eax
cmp dword [0x7d04f2bc], ebx
je 0x7d0169f5
cmp esi, dword [0x7d04f04c]
jne 0x7d0169f5
call edi
sub eax, dword [0x7d04f050]
cmp eax, 0x3e8
jae 0x7d016a2b
mov dword [0x7d04f04c], esi
call edi
mov dword [0x7d04f050], eax
mov eax, dword [0x7d04f2bc]
cmp eax, ebx
je 0x7d016a12
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push ebx
push ebx
push 0x91
push dword [0x7d04cdfc]
call dword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
mov dword [0x7d04f2bc], eax
pop edi
pop esi
pop ebx
ret

Function at 0x7d0170d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x14], 0x3a4
push ebx
push esi
push edi
je 0x7d0170f1
cmp dword [ebp + 0x14], 0x3b5
je 0x7d0170f1
and dword [ebp - 8], 0
jmp 0x7d0170f8
mov dword [ebp - 8], 1
mov edi, 0x800
mov ebx, 0x400
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x7d0171d8
mov eax, dword [ebp - 8]
mov dword [ebp - 4], edi
shl eax, 6
lea eax, [eax + 0x7d04bcd8]
mov dword [ebp - 0xc], eax
mov edi, 0x7cf44bd8
mov dword [ebp - 0x1c], esi
push edi
push ebx
push esi
push 0x7cf3339c
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebx - 5]
cmp eax, ecx
jb 0x7d01716a
add dword [ebp - 4], 0x400
push 0x42
push dword [ebp - 4]
add ebx, 0x200
push esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov esi, eax
test esi, esi
jne 0x7d017127
jmp 0x7d0171dd
xor ebx, ebx
cmp eax, 0x28
jb 0x7d0171dd
cmp word [esi], 0
je 0x7d017222
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push 2
push eax
push esi
call fcn.7d015673
cmp ax, 2
jne 0x7d0171dd
push edi
lea eax, [ebp - 0x10]
push 2
push eax
push esi
push dword [ebp - 0xc]
call fcn.7d015629
cmp ax, 2
jne 0x7d0171dd
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x14]
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
mov eax, dword [ebp - 0x14]
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7d016e61
cmp eax, 0xffffffff
je 0x7d017225
mov eax, dword [ebp - 0x18]
lea esi, [eax + 2]
jmp 0x7d017171
mov edi, 0x7cf44bd8
mov eax, dword [ebp - 8]
push edi
shl eax, 6
push 0
add eax, 0x7d04bcd8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, 0x7d04c220
mov ax, word [esi]
test ax, ax
je 0x7d017218
push dword [ebp + 0x14]
movzx eax, ax
push dword [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7d017237
inc esi
inc esi
cmp esi, 0x7d04c240
jb 0x7d0171f9
push 1
pop ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x7d017afb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x14], 0xffffffff
push esi
mov esi, dword [ebp + 8]
je 0x7d017b29
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x22
jne 0x7d017b18
push 0x22
inc eax
push dword [ebp + 0x10]
jmp 0x7d017b1d
push 0x20
push dword [ebp + 0x10]
push eax
push esi
call fcn.7d017a10
mov dword [ebp + 0xc], esi
jmp 0x7d017b2c
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x14], 0
je 0x7d017b7b
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharToOemA]
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x7d017b7b
cmp dword [ebp + 0x14], 1
jne 0x7d017b74
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x7d017b74
push 0x5c
push esi
call fcn.7d017a93
test eax, eax
je 0x7d017b74
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop esi
pop ebp
ret 0x10
Function at 0x7d019d60
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
call sym.SHELL32.dll_DragQueryFileW
push 1
pop ebx
cmp eax, ebx
jne 0x7d019dd4
lea eax, [ebp - 0x23c]
push 0x104
push eax
push edi
push dword [ebp + 8]
call sym.SHELL32.dll_DragQueryFileW
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test ah, 0x10
je 0x7d019daf
xor eax, eax
jmp 0x7d019e6f
lea eax, [ebp - 0x23c]
push eax
call fcn.7d019d38
test eax, eax
jne 0x7d019dd4
push edi
push edi
lea eax, [ebp - 0x23c]
push edi
push eax
call sym.SHELL32.dll_PifMgr_OpenProperties
mov esi, eax
cmp esi, edi
jne 0x7d019ddb
mov eax, ebx
jmp 0x7d019e6f
push esi
call fcn.7d019cbd
push edi
push esi
call fcn.7d019b69
cmp eax, edi
je 0x7d019e65
and byte [esi + 0x11], 0xfd
push 0x11
mov dword [ebp + 8], edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x34]
push eax
push ebx
push dword [ebp - 4]
push esi
call fcn.7d019bc7
mov ebx, eax
cmp ebx, edi
je 0x7d019e59
or byte [ebp - 0x30], 0x80
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x14], fcn.7d019d0d
mov dword [ebp - 0x10], edi
call dword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
cmp eax, edi
je 0x7d019e08
push dword [ebp + 0x10]
push eax
call dword [ebp + 0xc]
test eax, eax
je 0x7d019e4b
inc dword [esi + 0x24]
inc dword [ebp + 8]
jmp 0x7d019e08
lea eax, [ebp - 0x34]
push eax
push 1
push edi
call fcn.7d019d0d
jmp 0x7d019e08
cmp dword [ebp + 8], edi
jne 0x7d019e6c
push edi
push esi
call fcn.7d019c79
push edi
push esi
call sym.SHELL32.dll_PifMgr_CloseProperties
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7d01b061
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
test edi, edi
setne al
add eax, 0x8032
push eax
push dword [ebp + 0xc]
call esi
mov ecx, edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
neg ecx
sbb ecx, ecx
push 0
and ecx, 0x41
push 0
add ecx, 0x147
mov dword [ebp - 4], eax
push ecx
push eax
call ebx
xor ecx, ecx
cmp eax, ecx
jge 0x7d01b15f
cmp edi, ecx
jne 0x7d01b15f
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push ecx
push ecx
mov ebx, 0x8027
push 0x188
push ebx
push dword [ebp + 0xc]
call edi
lea ecx, [ebp - 0x80]
push ecx
push eax
push 0x189
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call edi
push 0x48
xor edi, edi
push 5
push ebx
mov word [ebp + 0x10], di
call fcn.7d01abe1
cmp ax, di
mov word [ebp + 0x12], ax
jne 0x7d01b14a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x170]
push 0x3c
push eax
push ebx
mov dword [esi + 0x44], 1
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x48
push 5
lea eax, [ebp - 0x170]
push 0x40
push eax
push 0x8129
push ebx
push dword [0x7d04cdfc]
call sym.SHELL32.dll_ShellMessageBoxW
add esp, 0x1c
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esi + 0x44], edi
xor eax, eax
jmp 0x7d01b273
push edi
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
lea eax, [ebp - 0x80]
push eax
push 0x36
push edi
call fcn.7d013321
jmp 0x7d01b177
neg edi
sbb edi, edi
push ecx
and edi, 0x49
push eax
add edi, 0x150
push edi
push dword [ebp - 4]
call ebx
mov edi, dword [ebp + 8]
test eax, eax
jge 0x7d01b181
mov eax, dword [edi + 0xa4]
cmp dword [edi + 0xa8], eax
lea ecx, [edi + 0xa8]
je 0x7d01b191
mov dword [ecx], eax
mov ecx, dword [edi + 0x34]
lea eax, [eax + eax*2]
push 0x7d04efc0
lea edi, [ecx + eax*8]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [edi + 0x10]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x80]
push eax
push 0x802c
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
movsx eax, word [edi + 4]
push eax
lea eax, [ebp - 0xf8]
push 0x7cf4208c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x802f
push dword [ebp + 0xc]
call esi
mov ebx, eax
lea eax, [ebp - 0xf8]
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 1
push 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_InvalidateRect]
call ebx
movsx eax, word [edi + 6]
push eax
lea eax, [ebp - 0xf8]
push 0x7cf4208c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x8030
push dword [ebp + 0xc]
call esi
lea ecx, [ebp - 0xf8]
mov dword [ebp + 8], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor edi, edi
push 1
push edi
push dword [ebp + 8]
call ebx
push 0x8034
push dword [ebp + 0xc]
call esi
push edi
push edi
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x8035
push dword [ebp + 0xc]
call esi
push 1
push edi
push eax
call ebx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7d01b2c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
push esi
push edi
lea edi, [ecx + eax + 0x18]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x7d01b2ee
mov eax, 0xc0000017
jmp 0x7d01b374
lea eax, [ebp - 4]
push eax
push edi
push esi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
test eax, eax
mov dword [ebp + 0x10], eax
jl 0x7d01b36a
push dword [esi + 0x10]
mov edi, dword [ebp + 0x14]
lea eax, [esi + 0x14]
push eax
push edi
call fcn.7d041e90
mov eax, dword [esi + 0x10]
add esp, 0xc
shr eax, 1
and word [edi + eax*2], 0
mov eax, dword [esi + 8]
push dword [esi + 0xc]
mov edi, dword [ebp + 0x1c]
add eax, esi
push eax
push edi
call fcn.7d041e90
mov eax, dword [esi + 4]
add esp, 0xc
cmp eax, 1
je 0x7d01b348
cmp eax, 7
jne 0x7d01b36a
mov eax, dword [esi + 0xc]
lea ecx, [eax + 2]
cmp ecx, dword [ebp + 0x18]
jbe 0x7d01b359
add eax, 0xfffffffe
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
and byte [edi + eax], 0
inc dword [esi + 0xc]
mov eax, dword [esi + 0xc]
and byte [edi + eax], 0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
leave
ret 0x18