joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d025938
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
push 1
xor ebx, ebx
cmp dword [edi + 0x38], 0xffffffff
pop esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
jne 0x7d025991
push 0x7cf48ba8
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, 0xffffffff
mov dword [edi + 0x38], eax
jne 0x7d025991
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x7d025980
call esi
jmp 0x7d025ac5
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x7d025ac5
push esi
mov ecx, edi
call fcn.7d025aee
cmp dword [ebp + 8], ebx
jne 0x7d025a3d
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push 0x7cf48b04
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7d025a3d
lea eax, [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 0x7cf48aec
push dword [ebp - 8]
mov dword [ebp + 8], 0x18
call esi
test eax, eax
jne 0x7d0259f7
cmp dword [ebp + 8], 0x18
jne 0x7d0259f7
lea eax, [ebp - 0x2c]
push eax
call fcn.7d02591c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 4
jne 0x7d025a34
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x7cf48ad8
push dword [ebp - 8]
call esi
test eax, eax
jne 0x7d025a34
cmp dword [ebp - 0x10], 4
jne 0x7d025a34
call fcn.7d03f9f2
movzx eax, ax
xor ecx, ecx
cmp eax, dword [ebp - 0x14]
setne cl
mov dword [ebp - 0xc], ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x7d025aba
lea eax, [ebp + 8]
push eax
push 0x7cf39470
push 3
push ebx
push 0x7cf39450
call fcn.7cf4d6fc
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7d025aba
push 0x18
call fcn.7d042358
mov esi, eax
pop ecx
cmp esi, ebx
je 0x7d025a86
mov ebx, dword [edi + 0x38]
push 0
mov ecx, esi
call fcn.7cf5eddd
mov dword [esi + 0x14], ebx
mov dword [esi], fcn.7cf6657e
xor ebx, ebx
jmp 0x7d025a88
xor esi, esi
cmp esi, ebx
je 0x7d025aac
mov eax, dword [ebp + 8]
push 0x10000000
push dword [edi + 0x38]
mov ecx, dword [eax]
push 0x7cf48928
push esi
push eax
call dword [ecx + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 4], ebx
jge 0x7d025ac2
push ebx
mov ecx, edi
call fcn.7d025aee
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7d025de9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
push edi
push 3
push dword [ebp + 8]
mov edi, ecx
call fcn.7d02603f
test eax, eax
je 0x7d025e0a
xor eax, eax
jmp 0x7d02603a
push esi
push ebx
xor esi, esi
push 0x400
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DeleteMenu]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x226]
push 0x40
push eax
push 0x766d
mov word [ebp - 0x1a6], si
push dword [0x7d04cdfc]
mov word [ebp - 0x122], si
call ebx
push esi
push 3
push 0x7cf36adc
mov dword [ebp - 0xa0], 7
mov word [ebp - 0x98], si
call sym.SHELL32.dll_Ordinal_72
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [edi + 0x14]
dec eax
dec eax
push eax
push dword [ebp + 8]
call fcn.7d025d2c
lea eax, [ebp - 0x226]
push 0x40
push eax
push 0x766e
push dword [0x7d04cdfc]
call ebx
push esi
push 0x1d
push 0x7cf36adc
call sym.SHELL32.dll_Ordinal_72
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [edi + 0x14]
dec eax
mov dword [ebp - 0xa0], 8
push eax
push dword [ebp + 8]
call fcn.7d025d2c
push esi
push esi
push 0x800
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_AppendMenuW]
push 0x7f02
push esi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 1
mov ecx, edi
mov dword [ebp - 0x18], eax
call fcn.7d025aee
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push esi
push 0x7cf48b04
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7d02601b
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x14], 0x40
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 4], 0x21c
mov dword [ebp - 8], 3
mov dword [ebp - 0x10], esi
call ebx
test eax, eax
jne 0x7d026012
lea eax, [ebp - 0x2b4]
push 0x7cf48aec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x7d025fd4
cmp dword [ebp - 4], 0x21c
jne 0x7d025fd4
cmp dword [ebp - 8], 3
jne 0x7d025fd4
push 0x4011
lea eax, [ebp - 0x568]
push 0x2b4
push eax
lea eax, [ebp - 0x1a6]
push 0x80
push eax
call sym.SHELL32.dll_SHGetFileInfoW
cmp eax, esi
mov dword [edi + 0x18], eax
je 0x7d025fbb
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x9c], eax
jmp 0x7d025fc2
or dword [ebp - 0x9c], 0xffffffff
lea eax, [ebp - 0x234]
push eax
push dword [edi + 0x14]
push dword [ebp + 8]
call fcn.7d025d2c
lea eax, [ebp - 4]
inc dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x14], 0x40
push eax
mov dword [ebp - 4], 0x21c
push dword [ebp - 0x10]
mov dword [ebp - 8], 3
push dword [ebp - 0xc]
jmp 0x7d025f55
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov ecx, edi
call fcn.7d025aee
push 1
mov ecx, edi
call fcn.7d025938
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_SetCursor]
push 1
pop eax
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x7d0261a0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
xor ebx, ebx
push edi
push ebx
lea eax, [ebp - 0x410]
push 0x15
push eax
push ebx
mov word [ebp - 0x208], bx
call sym.SHELL32.dll_Ordinal_175
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsAndAttributesW]
test eax, eax
je 0x7d026200
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push ebx
push eax
call edi
test eax, eax
jne 0x7d026200
mov word [ebp - 0x208], bx
cmp word [ebp - 0x208], bx
jne 0x7d02628f
push ebx
lea eax, [ebp - 0x410]
push 0x2d
push eax
push ebx
call sym.SHELL32.dll_Ordinal_175
test eax, eax
je 0x7d02624c
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push ebx
push eax
call edi
test eax, eax
jne 0x7d02624c
mov word [ebp - 0x208], bx
cmp word [ebp - 0x208], bx
jne 0x7d02628f
lea eax, [ebp - 0x410]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x410]
push 0x7cf489c8
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
push ebx
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x7d0262bd
push dword [ebp + 8]
call fcn.7cfae617
push ebx
push dword [ebp + 8]
push 5
push 2
call sym.SHELL32.dll_SHChangeNotify
xor eax, eax
jmp 0x7d0262d9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x7d0262cd
call esi
jmp 0x7d0262d9
call esi
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7d027029
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
add ecx, 0xffffff90
neg esi
sbb esi, esi
and esi, ecx
mov ecx, dword [esi + 0x8c]
lea eax, [esi + 0x8c]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x4c]
test esi, esi
je 0x7d027055
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x7d027ba6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
add ecx, 0xffffff78
neg esi
sbb esi, esi
and esi, ecx
mov ecx, dword [esi + 0x90]
lea eax, [esi + 0x90]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x6c]
test esi, esi
je 0x7d027bd5
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x7d029084
Capabilities:
Find taskbar

Disassembly:
push esi
call fcn.7d02901a
mov esi, eax
test esi, esi
jl 0x7d0290b3
push 0
push 0x7cf49528
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x7d0290b3
push 0
push dword [esp + 0xc]
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, esi
pop esi
ret 4
Function at 0x7d029303
Capabilities:
Modify service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 8], esi
call fcn.7d02901a
cmp eax, esi
jge 0x7d029323
xor ax, ax
jmp 0x7d0293c2
push ebx
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x7d0293a6
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
and ecx, 2
neg edx
sbb edx, edx
and edx, 0xfffffff0
add edx, 0x20
or ecx, edx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
je 0x7d0293a8
cmp dword [ebp + 0x10], esi
je 0x7d029381
mov eax, dword [ebp + 0xc]
push esi
push esi
push esi
neg eax
push esi
push esi
sbb eax, eax
push esi
push esi
add eax, 3
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [ebp + 0xc], esi
je 0x7d029391
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x7d02939e
lea eax, [ebp - 0x24]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, esi
je 0x7d0293a6
or dword [ebp - 8], 0xffffffff
cmp edi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x7d0293b3
push edi
call ebx
cmp dword [ebp - 4], esi
je 0x7d0293bd
push dword [ebp - 4]
call ebx
mov ax, word [ebp - 8]
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x7d02a263
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push esi
mov esi, 0x104
push edi
lea eax, [ebp - 0x620]
and word [ebp - 0x418], 0
push esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.7d02a23f
push esi
lea eax, [ebp - 0x210]
push 0x7cf497cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push esi
lea eax, [ebp - 0x210]
push 0x7cf35574
push eax
call edi
lea eax, [ebp - 0x620]
push esi
push eax
lea eax, [ebp - 0x210]
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.SHLWAPI.dll_ParseURLA
call esi
test eax, eax
je 0x7d02a2f9
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.SHLWAPI.dll_ParseURLW
call esi
test eax, eax
jne 0x7d02a325
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x10]
lea eax, [ebp - 0x418]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
call fcn.7d02a1c7
pop edi
pop esi
leave
ret 0x10
Function at 0x7d02d193
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
add ecx, 0xffffff9c
neg esi
sbb esi, esi
and esi, ecx
mov ecx, dword [esi + 0x78]
lea eax, [esi + 0x78]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x4c]
test esi, esi
je 0x7d02d1b9
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x7d02d223
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 0x80
push 3
push edi
push 1
push ParseURLA
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x7d02d294
lea ecx, [ebp - 4]
push edi
push ecx
lea ecx, [ebp + 8]
push 2
push ecx
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7d02d294
cmp dword [ebp - 4], 2
jne 0x7d02d294
mov ax, word [ebp + 8]
cmp ax, word [0x7d04c534]
jne 0x7d02d282
mov dword [esi + 4], 2
jmp 0x7d02d294
push edi
push edi
push edi
mov dword [esi + 4], 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x7d02d2b2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.7d041c90
push ebx
mov ebx, ecx
push esi
xor esi, esi
cmp dword [ebx], 0xffffffff
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x7d02d423
cmp dword [ebx + 4], 2
jne 0x7d02d387
cmp dword [ebp + 8], 2
jne 0x7d02d2fc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.7d02d484
jmp 0x7d02d39e
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x7d02d42a
mov ebx, 0x824
cmp dword [ebp + 0xc], ebx
jae 0x7d02d31a
mov ebx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push 0
push eax
lea eax, [ebx + ebx]
push eax
lea eax, [ebp - 0x1058]
push eax
mov eax, dword [ebp - 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7d02d423
mov eax, dword [ebp + 0x10]
shr eax, 1
mov dword [ebp + 0x10], eax
and word [ebp + eax*2 - 0x1058], 0
inc eax
push eax
lea eax, [ebp - 0x1058]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToAnsi]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0x10]
add dword [ebp - 4], edx
cmp edx, ebx
lea edi, [edi + eax - 1]
mov dword [ebp + 0xc], ecx
lea esi, [esi + eax - 1]
jb 0x7d02d42a
test ecx, ecx
jne 0x7d02d30d
jmp 0x7d02d42a
cmp dword [ebp + 8], 1
jne 0x7d02d3a9
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.7d02d441
mov esi, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x7d02d42a
mov eax, dword [ebp + 0x10]
cmp eax, esi
mov dword [ebp + 8], eax
je 0x7d02d42a
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, 0x824
cmp ecx, eax
mov dword [ebp + 0xc], ecx
jb 0x7d02d3c8
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x834]
push dword [ebp + 0xc]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7d02d423
mov eax, dword [ebp + 0x10]
and byte [ebp + eax - 0x834], 0
inc eax
push eax
lea eax, [ebp - 0x834]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHAnsiToUnicode]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0x10]
add dword [ebp - 4], edx
lea edi, [edi + eax*2 - 2]
lea esi, [esi + eax - 1]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
cmp edx, eax
jb 0x7d02d42a
test ecx, ecx
jne 0x7d02d3b6
jmp 0x7d02d42a
mov dword [ebp - 8], 0x80004005
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 0x14
Function at 0x7d02d484
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
and dword [ebp - 4], 0
push esi
cmp eax, 0xffffffff
mov esi, 0x80004005
je 0x7d02d4be
cmp dword [ecx + 4], 2
jne 0x7d02d4be
lea ecx, [ebp - 4]
push 0
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7d02d4be
shr dword [ebp - 4], 1
xor esi, esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x7d02d548
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x14]
push ebx
cmp eax, dword [ebp + 0x18]
push esi
push edi
jne 0x7d02d60c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7d02d60c
lea eax, [ebp - 8]
mov dword [ebp + 0x14], 8
push eax
push dword [ebp + 0xc]
call fcn.7cf6bfb1
lea eax, [ebp + 0x14]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x7cf49dd8
push dword [ebp + 8]
mov ebx, reloc.SHLWAPI.dll_ParseURLA
push ebx
call esi
test eax, eax
je 0x7d02d5b1
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x7d02d5c1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x7d02d608
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 8
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x7cf49da8
push dword [ebp + 8]
push ebx
call esi
test eax, eax
je 0x7d02d5ea
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x20]
jne 0x7d02d60c
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c]
jne 0x7d02d60c
xor eax, eax
jmp 0x7d02d60f
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x7d02d6ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], 0x14
jne 0x7d02d6c9
lea esi, [ebp + 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 8]
push eax
push 0x7cf49e18
push 0x7cf49e4c
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x7d02d708
cmp dword [ebp - 4], edi
je 0x7d02d708
cmp dword [ebp + 8], 1
jne 0x7d02d708
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 1
mov dword [esi], eax
pop edi
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x7d02d710
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
mov esi, ecx
push edi
lea eax, [ebp - 0x228]
push dword [esi + 0x630]
push 0x7cf49ee0
push 0x104
push eax
call fcn.7d032e56
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x7cf37f04
lea eax, [ebp - 8]
push ebx
push eax
call edi
mov al, byte [esi + 0x638]
push ebx
and eax, 1
add word [ebp - 8], ax
lea eax, [ebp - 4]
push eax
call edi
mov al, byte [esi + 0x638]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
and eax, 2
mov edi, reloc.SHLWAPI.dll_ParseURLA
add word [ebp - 4], ax
xor eax, eax
cmp dword [esi + 0x658], eax
jne 0x7d02d78e
cmp dword [esi + 0x65c], eax
je 0x7d02d812
cmp dword [esi + 0x684], eax
jne 0x7d02d7bc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x228]
push 0x7cf49dfc
push eax
push edi
call ebx
xor eax, eax
cmp dword [0x7d04ce40], eax
je 0x7d02d7f2
cmp dword [esi + 0x684], eax
jne 0x7d02d7f2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x228]
push 0x7cf49e18
push eax
push edi
call ebx
xor eax, eax
cmp dword [esi + 0x680], eax
jne 0x7d02d812
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0x228]
push 0x7cf3d390
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHRegSetPathW]
lea eax, [esi + 0x18]
push eax
mov dword [ebp - 0xc], eax
call fcn.7d03235f
test eax, eax
mov dword [ebp - 0x10], eax
je 0x7d02d83a
push 0x104
lea eax, [esi + 0x220]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [esi + 0x680], 0
jne 0x7d02d8ab
lea ecx, [ebp - 0x18]
lea eax, [esi + 0x220]
push ecx
push eax
call fcn.7cf6bfb1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esi + 0x220]
push 0
push eax
lea eax, [ebp - 0x228]
push 0x7cf49ec0
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHRegSetPathW]
lea eax, [ebp - 0x18]
push 8
push eax
push 3
lea eax, [ebp - 0x228]
push 0x7cf49dd8
push eax
push edi
call ebx
lea eax, [ebp - 0x20]
push 8
push eax
push 3
lea eax, [ebp - 0x228]
push 0x7cf49da8
push eax
push edi
call ebx
cmp dword [esi + 0x658], 0
je 0x7d02d93d
cmp dword [esi + 0x684], 0
jne 0x7d02d8e3
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 8]
push eax
push 1
push 0x7cf49dfc
push 0x7cf3d3a4
push edi
call ebx
cmp dword [0x7d04ce40], 0
je 0x7d02d917
cmp dword [esi + 0x684], 0
jne 0x7d02d917
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x7cf49e18
push 0x7cf3d3a4
push edi
call ebx
xor eax, eax
cmp dword [esi + 0x680], eax
jne 0x7d02d93d
cmp dword [ebp - 0x10], eax
je 0x7d02d92b
mov esi, dword [ebp - 0xc]
jmp 0x7d02d931
add esi, 0x220
push 1
push esi
push eax
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7d02d942
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push 0x7cf34808
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x7d02da75
push edi
push esi
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [esi + 0x10], eax
lea edi, [esi + 0x24c]
push edi
call ebx
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push 0x7cf49ffc
push dword [ebp + 0xc]
call edi
lea eax, [esi + 0x1294]
push eax
call ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 0x1294]
push eax
push 1
push 0
push 0x7cf49fe0
push dword [ebp + 0xc]
call edi
lea eax, [esi + 0x44]
push eax
call ebx
lea eax, [eax + eax + 2]
xor ebx, ebx
push eax
lea eax, [esi + 0x44]
push eax
push 1
push ebx
push 0x7cf49fc4
push dword [ebp + 0xc]
call edi
mov eax, dword [esi + 8]
cmp dword [esi + 0xc], ebx
mov dword [ebp + 8], eax
je 0x7d02d9f8
or byte [ebp + 9], 0x20
cmp dword [esi + 0x14], ebx
je 0x7d02da01
or byte [ebp + 9], 0x40
lea eax, [ebp + 8]
push 4
push eax
push 4
push ebx
push 0x7cf37ecc
push dword [ebp + 0xc]
call edi
lea eax, [esi + 0x18]
push 0x2c
push eax
push 3
push ebx
push 0x7cf49fb0
push dword [ebp + 0xc]
call edi
lea eax, [esi + 0x22dc]
push 4
push eax
push 4
push ebx
push 0x7cf49f94
push dword [ebp + 0xc]
call edi
lea eax, [esi + 0x22e0]
push 0x18
push eax
push 3
push ebx
push 0x7cf49f70
push dword [ebp + 0xc]
call edi
add esi, 0x22f8
push 0x18
push esi
push 3
push ebx
push 0x7cf49f4c
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
pop edi
leave
ret 0xc