joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cdfa457
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
push esi
push esi
mov dword [ebp - 0x1c], eax
call fcn.7cd937cd
mov edi, eax
cmp edi, esi
jl 0x7cdfa5a7
movzx eax, word [0x7ce4fd8c]
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x7cdfa56a
movzx eax, word [0x7ce4fd8c]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x7cdfa56a
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
cmp dword [ebx], esi
jne 0x7cdfa56a
cmp dword [ebx + 4], esi
jbe 0x7cdfa56a
mov edi, dword [ebx + 4]
call fcn.7cdb9dcf
cmp edi, eax
jae 0x7cdfa4e7
push edi
push esi
push dword [0x7ce50ed0]
call dword [0x7ce4df60]
mov dword [ebp - 4], eax
jmp 0x7cdfa4ec
mov dword [ebp - 4], esi
mov eax, esi
cmp eax, esi
je 0x7cdfa561
push 0xe
mov esi, ebx
pop ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebx + 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
jbe 0x7cdfa550
add eax, 0x18
mov dword [ebp - 0xc], eax
lea eax, [ebx + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x7cdfa53a
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x20
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x14]
jmp 0x7cdfa540
mov eax, dword [ebp - 4]
dec dword [eax + 0xc]
add dword [ebp - 8], 0x20
inc esi
cmp esi, dword [ebx + 0xc]
mov dword [ebp - 0x14], esi
jb 0x7cdfa512
mov eax, dword [ebp - 4]
imul esi, esi, 0x7ffffff
add esi, dword [ebp - 0x10]
shl esi, 5
add dword [eax + 4], esi
xor esi, esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
push ebx
call fcn.7cdfabb1
mov edi, eax
cmp edi, esi
jl 0x7cdfa590
push 1
push dword [ebp - 0x1c]
push dword [ebx]
call fcn.7cdfa37a
jmp 0x7cdfa5ac
cmp dword [ebp - 4], esi
je 0x7cdfa5ac
push dword [ebp - 4]
push esi
push dword [0x7ce50ed0]
call dword [0x7ce4df64]
jmp 0x7cdfa5ac
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7cdfa6d9
Capabilities:
Read clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x1c], ebx
lea esi, [edi + 0x1c]
jne 0x7cdfa74f
cmp dword [edi + 0x20], 1
je 0x7cdfa74f
movzx eax, word [0x7ce4fd64]
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x7cdfa74f
push ebx
push ebx
call fcn.7cd937cd
cmp eax, ebx
jne 0x7cdfa74f
movzx eax, word [0x7ce4fd64]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
je 0x7cdfa734
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x7cdfa734
mov ebx, dword [eax]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
je 0x7cdfa74f
push 0x7cd81000
push esi
push 0x7cd76298
push ebx
call fcn.7cdac471
mov eax, dword [esi]
mov dword [edi + 0x20], 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x7cdfadb5
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
je 0x7cdfadca
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x7cdfadd3
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x7cdfaddc
mov dword [eax], ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x7cdfadf8
mov dword [ebp - 4], 0x800401d3
jmp 0x7cdfaef7
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, ebx
jne 0x7cdfae11
mov dword [ebp - 4], 0x8007000e
jmp 0x7cdfaef7
cmp edi, ebx
je 0x7cdfae30
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
push ebx
push esi
not ecx
push ecx
call fcn.7cdab540
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x7cdfaeaa
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp dword [ebp + 0x10], ebx
lea esi, [ecx + esi + 1]
je 0x7cdfae60
push dword [ebp + 0x10]
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
push ebx
push esi
not ecx
push ecx
call fcn.7cdab540
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x7cdfaeaa
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp dword [ebp + 0x14], ebx
lea esi, [ecx + esi + 1]
je 0x7cdfae90
push dword [ebp + 0x14]
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
push ebx
push esi
not ecx
push ecx
call fcn.7cdab540
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x7cdfaeaa
mov edi, dword [ebp + 0x18]
cmp edi, ebx
je 0x7cdfaeaa
push esi
call fcn.7ce06572
cmp eax, ebx
mov dword [edi], eax
jne 0x7cdfaeaa
mov dword [ebp - 4], 0x8007000e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 4], ebx
je 0x7cdfaef7
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x7cdfaecd
mov eax, dword [esi]
cmp eax, ebx
je 0x7cdfaecd
push eax
call sym.ole32.dll_CoTaskMemFree
mov dword [esi], ebx
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x7cdfaee2
mov eax, dword [esi]
cmp eax, ebx
je 0x7cdfaee2
push eax
call sym.ole32.dll_CoTaskMemFree
mov dword [esi], ebx
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x7cdfaef7
mov eax, dword [esi]
cmp eax, ebx
je 0x7cdfaef7
push eax
call sym.ole32.dll_CoTaskMemFree
mov dword [esi], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7cdfb5e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], ecx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], 0x200
call fcn.7cdfadb5
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x7cdfb736
lea eax, [ebp - 0x38]
push 1
push eax
push dword [ebp - 8]
call fcn.7ce05d1f
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x7cdfb736
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x7cdfb67e
push dword [ebp - 8]
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push dword [ebp - 0xc]
mov edi, eax
call esi
add edi, eax
lea edi, [edi + edi + 4]
call fcn.7cdb9dcf
cmp edi, eax
jae 0x7cdfb6c4
push dword [ebp - 4]
call esi
push dword [ebp - 0xc]
mov edi, eax
call esi
add edi, eax
lea eax, [edi + edi + 4]
push eax
push ebx
push dword [0x7ce50ed0]
call dword [0x7ce4df60]
mov dword [ebp - 0x10], eax
jmp 0x7cdfb6c7
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp - 0x10]
cmp edi, ebx
je 0x7cdfb721
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x7cdfb6f8
cmp word [eax], bx
je 0x7cdfb6f8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x7cd73704
push edi
call esi
push dword [ebp - 4]
push edi
call esi
lea eax, [ebp - 0x238]
push edi
push eax
lea eax, [ebp - 0x28]
push 0x30
push eax
lea eax, [ebp - 0x20]
lea esi, [ebp - 0x38]
push eax
push 1
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.7cdf505a
cmp eax, ebx
jne 0x7cdfb72a
mov dword [ebp + 8], 0x8007000e
jmp 0x7cdfb736
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
cmp dword [ebp - 8], ebx
je 0x7cdfb743
push dword [ebp - 8]
call sym.ole32.dll_CoTaskMemFree
cmp dword [ebp - 0xc], ebx
je 0x7cdfb750
push dword [ebp - 0xc]
call sym.ole32.dll_CoTaskMemFree
cmp dword [ebp - 4], ebx
je 0x7cdfb75d
push dword [ebp - 4]
call sym.ole32.dll_CoTaskMemFree
cmp dword [ebp - 0x10], ebx
je 0x7cdfb772
push dword [ebp - 0x10]
push ebx
push dword [0x7ce50ed0]
call dword [0x7ce4df64]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7cdfb8d6
Capabilities:
Read clipboard data

Disassembly:
movzx eax, word [0x7ce4fd48]
push ebx
push ebp
push eax
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x7cdfb917
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x7cdfb917
push edi
push esi
push 9
mov esi, eax
pop ecx
mov edi, 0x7cd810bc
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x7cdfb90e
push 1
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x7cdfbf0a
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push edi
xor edi, edi
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
cmp eax, 6
jae 0x7cdfbf46
push esi
lea esi, [eax*8 + 0x7cd810ec]
push dword [esi - 4]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x7cdfbf3a
mov ax, word [esi]
or edi, eax
add esi, 8
cmp esi, 0x7cd8111c
jb 0x7cdfbf27
pop esi
mov ax, di
pop edi
ret 4

Function at 0x7cdfc26a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 4]
mov dword [0x7ce4d234], 0x32
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x7cd81118
push 0x80000001
mov dword [ebp - 4], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7cdfc2b4
push eax
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.ntdll.dll_wcstol
add esp, 0xc
mov dword [0x7ce4d234], eax
leave
ret
Function at 0x7cdfcc0e
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov ebp, ecx
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 0x10], esi
je 0x7cdfcc26
xor eax, eax
jmp 0x7cdfccc5
push edi
lea eax, [esp + 0x14]
push dword [ebp + 0x14]
push str.DragDrop_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push esi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
cmp edi, esi
mov dword [esp + 0x10], edi
je 0x7cdfcc72
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
jne 0x7cdfcc76
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], esi
cmp ebx, esi
je 0x7cdfccb3
push dword [ebx + 4]
push esi
push dword [0x7ce50ed0]
call dword [0x7ce4df60]
cmp eax, esi
mov dword [ebp + 0x10], eax
je 0x7cdfcca2
mov ecx, dword [ebx + 4]
mov edi, eax
mov eax, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
pop edi
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
pop esi
pop ebp
pop ebx
add esp, 0x44
ret

Function at 0x7cdfe0f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
lea eax, [ebp - 4]
push esi
mov esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 4], 0x400
and dword [esi], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x7cdfe146
lea eax, [ebp - 0x404]
push eax
call fcn.7cd92b60
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
jmp 0x7cdfe14b
mov eax, 0x80040152
pop esi
leave
ret 0xc
Function at 0x7cdfe511
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
push edi
mov word [ebp - 0xa8], si
jne 0x7cdfe54a
cmp dword [ebp + 0xc], esi
je 0x7cdfe544
push 0x29
lea eax, [ebp - 0x54]
push dword [ebp + 0xc]
mov word [ebp - 2], si
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x7cdfe5b2
mov word [ebp - 0x54], si
jmp 0x7cdfe5b2
push esi
lea eax, [ebp - 0x54]
push 0x2a
push eax
push 2
push dword [ebp + 8]
call fcn.7cdff0e1
test eax, eax
jne 0x7cdfe5b2
push esi
lea eax, [ebp - 0x54]
push 0x2a
push eax
push dword [ebp + 8]
call fcn.7cdfefe3
test eax, eax
jne 0x7cdfe5b2
cmp word [ebp - 0xa8], si
jne 0x7cdfe5a1
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0x54
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x7cd81420
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov word [ebp - 0x56], si
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x2a8]
push eax
push dword [ebp + 8]
call fcn.7cdfe61f
mov edi, eax
cmp edi, esi
jne 0x7cdfe5fa
lea eax, [ebp - 0x2a8]
push 0x100
push eax
push dword [0x7ce4fd38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x7cdfe617
push 8
mov dword [ebp + 0xc], esi
push dword [0x7ce4fd38]
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
call sym.ole32.dll_OleMetafilePictFromIconAndLabel
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, esi
pop edi
pop esi
leave
ret 0xc
Function at 0x7cdfe743
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x10
mov edi, ebx
pop ecx
mov esi, 0x7cd84458
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x7cdfe90e
push ebx
call sym.ole32.dll_CoIsOle1Class
test eax, eax
je 0x7cdfe7fd
lea eax, [ebp - 8]
push eax
push ebx
call sym.ole32.dll_ProgIDFromCLSID
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push dword [ebp - 8]
mov esi, eax
call sym.ole32.dll_CoTaskMemFree
test esi, esi
jne 0x7cdfe90e
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x110
push eax
lea eax, [ebp - 0x118]
push eax
push 0x7cd814b4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x7cdfe90e
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
and word [ecx + eax*2 - 2], si
dec eax
push eax
lea eax, [ebp - 0x118]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp + 0x14]
push 1
and dword [eax], esi
pop eax
jmp 0x7cdfe910
lea eax, [ebp - 8]
push eax
push ebx
call sym.ole32.dll_StringFromCLSID
lea eax, [ebp - 0x198]
push 0x7cd814a4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 8]
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 8]
call sym.ole32.dll_CoTaskMemFree
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cdfe90e
lea eax, [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x7cd8148c
push dword [ebp - 4]
mov edi, 0x110
mov dword [ebp + 8], edi
call esi
mov ebx, eax
test ebx, ebx
je 0x7cdfe8b0
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0x118]
push eax
push 0x7cd7264c
push dword [ebp - 4]
call esi
mov ebx, eax
test ebx, ebx
je 0x7cdfe8b0
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0x118]
push eax
push 0x7cd81474
push dword [ebp - 4]
call esi
mov ebx, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x7cdfe90e
mov esi, 0x88
lea eax, [ebp - 0x2a8]
push esi
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
mov dword [ebp + 8], eax
je 0x7cdfe90e
cmp eax, esi
jg 0x7cdfe90e
push dword [ebp + 0x14]
lea eax, [ebp - 0x2a8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.7cdfe682
push dword [ebp + 0x14]
lea eax, [ebp - 0x118]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.7cdfe682
jmp 0x7cdfe910
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7cdfefe3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
jne 0x7cdff01b
lea eax, [ebp + 0x14]
push eax
push ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebx
jne 0x7cdff0d7
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sym.ole32.dll_StringFromCLSID
lea eax, [ebp - 0x10c]
push 0x7cd814a4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 8]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 8]
call sym.ole32.dll_CoTaskMemFree
mov eax, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea esi, [eax + eax]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0x14]
call edi
mov ecx, dword [ebp - 4]
shr ecx, 1
cmp eax, ebx
mov dword [ebp - 4], ecx
je 0x7cdff0c9
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x7cdff0c9
push dword [ebp + 8]
call sym.ole32.dll_CoIsOle1Class
test eax, eax
je 0x7cdff0c9
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call sym.ole32.dll_ProgIDFromCLSID
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
call edi
push dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
call sym.ole32.dll_CoTaskMemFree
cmp esi, ebx
je 0x7cdff0c9
mov dword [ebp - 4], ebx
cmp dword [ebp - 0xc], ebx
je 0x7cdff0d7
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7cdff0e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov word [edi], bx
jne 0x7cdff123
lea eax, [ebp + 0x10]
push eax
push ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebx
jne 0x7cdff1bf
mov dword [ebp - 8], 1
jmp 0x7cdff126
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 8]
call sym.ole32.dll_StringFromCLSID
lea eax, [ebp - 0x248]
push 0x7cd814a4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x248]
push eax
call esi
movzx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x48]
push 0x7cd814fc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x248]
push eax
call esi
push dword [ebp + 0x18]
call sym.ole32.dll_CoTaskMemFree
mov eax, dword [ebp + 0x14]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x248]
push edi
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 4]
shr ecx, 1
cmp eax, ebx
mov dword [ebp - 4], ecx
je 0x7cdff1b1
mov dword [ebp - 4], ebx
mov word [edi], bx
cmp dword [ebp - 8], ebx
je 0x7cdff1bf
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7ce08458
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x7ce0847c
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x7ce08486
mov esi, 0x80030009
jmp 0x7ce0860e
cmp dword [ebp + 8], ebx
mov dword [edi], ebx
je 0x7ce084a4
push 0x104
push dword [ebp + 8]
call fcn.7ce393d8
mov esi, eax
cmp esi, ebx
jl 0x7ce0860c
cmp dword [ebp + 0x14], ebx
jne 0x7ce08658
mov ebx, dword [ebp + 0x10]
test ebx, 0x8000000
je 0x7ce084e0
cmp dword [ebp + 0xc], 0
jne 0x7ce08607
cmp dword [ebp + 0x18], 0x200
ja 0x7ce08658
push edi
push 0
push ebx
push dword [ebp + 8]
call fcn.7cda1628
jmp 0x7ce085a7
push 1
push ebx
call fcn.7ce392e2
mov esi, eax
test esi, esi
jl 0x7ce0860c
test bl, 3
je 0x7ce08607
mov ecx, ebx
mov eax, 0x4020000
and ecx, eax
cmp ecx, eax
je 0x7ce08607
push ebx
call fcn.7cd86168
mov edi, eax
mov ecx, ebx
mov eax, 0x30000
and ecx, eax
cmp ecx, eax
jne 0x7ce08524
or edi, 4
mov ecx, dword [ebp + 0x18]
mov eax, 0x200
cmp ecx, eax
mov edx, 0x1000
jbe 0x7ce08648
or edi, 0x80000
cmp ecx, edx
je 0x7ce0863c
cmp ecx, 0x2000
je 0x7ce08630
cmp ecx, 0x4000
je 0x7ce08624
cmp ecx, 0x8000
jne 0x7ce08658
mov dword [ebp - 4], 0xf000
mov esi, ebx
and esi, edx
je 0x7ce085ab
push dword [ebp + 8]
call fcn.7ce1b341
test eax, eax
jl 0x7ce085ab
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x7ce085ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x7ce085ab
cmp eax, 3
je 0x7ce085ab
push eax
call fcn.7ce3959e
mov esi, eax
jmp 0x7ce0860c
call sym.ole32.dll_CoFreeAllLibraries
xor eax, eax
lea ecx, [ebp - 8]
push eax
push eax
push ecx
mov ecx, dword [ebp + 0x1c]
push eax
mov eax, ebx
and eax, 0x4000000
and ecx, 0x20000000
or eax, 0x1000000
and ebx, 0x20000
shr eax, 2
or eax, ecx
shr eax, 3
or eax, ebx
shr eax, 6
or eax, esi
shr eax, 0xb
or eax, dword [ebp - 4]
push eax
push edi
push dword [ebp + 8]
call fcn.7ce0809c
mov esi, eax
test esi, esi
jl 0x7ce0860c
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp - 8]
and dword [ebp - 8], 0
mov dword [ecx], eax
jmp 0x7ce0860c
mov esi, 0x800300ff
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x7ce0861b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
mov dword [ebp - 4], 0xe000
jmp 0x7ce08572
mov dword [ebp - 4], 0xd000
jmp 0x7ce08572
mov dword [ebp - 4], 0xc000
jmp 0x7ce08572
test ecx, ecx
je 0x7ce08572
cmp ecx, eax
je 0x7ce08572
mov esi, 0x80030057
jmp 0x7ce0860c