joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cff2c9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
mov word [eax], bx
cmp dword [0x7d04b6a4], 0xffffffff
push 1
mov edi, ecx
pop esi
jne 0x7cff2d20
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x7cf42c90
push 0x7cf33008
push reloc.SHLWAPI.dll_ParseURLW
mov dword [0x7d04b6a4], ebx
mov dword [0x7d04b6a0], ebx
mov dword [0x7d04b6a8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x7cff2d20
cmp dword [ebp - 4], esi
jne 0x7cff2d06
mov dword [0x7d04b6a4], esi
jmp 0x7cff2d20
cmp dword [ebp - 4], 2
jne 0x7cff2d14
mov dword [0x7d04b6a8], esi
jmp 0x7cff2d20
cmp dword [ebp - 4], 4
jne 0x7cff2d20
mov dword [0x7d04b6a0], esi
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x210]
push 0x104
push ecx
mov ecx, edi
call dword [eax + 0x38]
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7cff2dcb
cmp dword [0x7d04b6a8], ebx
je 0x7cff2d5c
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x7cff2dcb
cmp dword [edi + 0x778], 4
jne 0x7cff2d6d
cmp dword [0x7d04b6a4], ebx
jne 0x7cff2d77
cmp dword [0x7d04b6a0], ebx
jne 0x7cff2d77
xor esi, esi
mov ecx, edi
call fcn.7cff3b78
movzx eax, ax
neg esi
sbb esi, esi
push eax
and esi, 4
lea eax, [ebp - 0x210]
add esi, 0x2408
push eax
movzx eax, si
push eax
push dword [0x7d04cdfc]
call fcn.7cf5e09c
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x7cff2dc4
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7cff2dcb
mov dword [ebp - 4], 0x8007000e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7cff4237
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x7d04b6ac]
push esi
cmp eax, 0x2a
jne 0x7cff42dd
mov esi, 0x104
lea eax, [ebp - 0x208]
push esi
push eax
push 0x1004
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x7cff42a2
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
cmp eax, 0x4e4
je 0x7cff42a2
cmp eax, 0x4e6
je 0x7cff42a2
cmp eax, 0x4e7
je 0x7cff42a2
cmp eax, 0x4e9
je 0x7cff42a2
cmp eax, 0x4ea
jne 0x7cff42d5
lea eax, [ebp - 0x208]
push esi
push eax
push 0x24b4
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x208], 0xbc
jne 0x7cff42d5
cmp word [ebp - 0x206], 0xbd
jne 0x7cff42d5
xor eax, eax
jmp 0x7cff42d8
push 1
pop eax
mov dword [0x7d04b6ac], eax
pop esi
leave
ret

Function at 0x7cff43e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push edi
xor edi, edi
push eax
push 0x2000000
push edi
push 0x7cf43218
mov dword [esi], edi
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebx], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cff4443
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 4
push eax
push esi
push edi
push edi
push 0x7cf37ecc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7cff443a
mov dword [esi], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], edi
je 0x7cff445a
push 0x7cf3c584
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
neg eax
sbb eax, eax
inc eax
inc eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7cff71aa
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
push edi
jl 0x7cff724d
cmp ebx, 0x19
jg 0x7cff724d
cmp dword [0x7d04e7d0], 0
jne 0x7cff724d
mov eax, dword [0x7cf32e54]
mov dword [ebp - 0x18], eax
mov eax, dword [0x7cf32e58]
add word [ebp - 0x18], bx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x7cff7241
mov esi, 0x7cf34ad8
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add word [ebp - 0x10], bx
push 0x4000
mov dword [ebp + 8], 4
call fcn.7cff4398
test eax, eax
je 0x7cff724d
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.7cf837f2
test eax, eax
jne 0x7cff723a
cmp dword [ebp - 8], 1
je 0x7cff7241
cmp eax, 0x4b1
jne 0x7cff724d
push dword [ebp + 0xc]
push ebx
call fcn.7cff7a67
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7cff7dc2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 4
pop ecx
cmp eax, ecx
jne 0x7cff7dfc
push 0xaf8
call fcn.7d042358
test eax, eax
pop ecx
je 0x7cff7eac
mov ecx, eax
call fcn.7cff7ee5
mov esi, eax
jmp 0x7cff7eae
cmp eax, 1
je 0x7cff7e1b
push 0x808
call fcn.7d042358
mov esi, eax
pop ecx
test esi, esi
je 0x7cff7eac
jmp 0x7cff7e9d
cmp dword [ebp + 0xc], 0
je 0x7cff7e88
push 3
lea eax, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
and word [ebp - 0xc], 0
push 0x8000
call fcn.7cff4398
test eax, eax
je 0x7cff7e88
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.7cf837f2
test eax, eax
jne 0x7cff7e65
cmp dword [ebp - 8], 1
je 0x7cff7e6c
cmp eax, 0x4b1
jne 0x7cff7e88
push 0xaf8
call fcn.7d042358
test eax, eax
pop ecx
je 0x7cff7e86
mov ecx, eax
call fcn.7cff7ee5
mov esi, eax
jmp 0x7cff7e88
xor esi, esi
test esi, esi
jne 0x7cff7eb2
push 0x808
call fcn.7d042358
mov esi, eax
pop ecx
test esi, esi
je 0x7cff7eac
mov ecx, esi
call fcn.7cff32a3
mov dword [esi], 0x7cf43460
jmp 0x7cff7eae
xor esi, esi
test esi, esi
je 0x7cff7ec2
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0x84]
mov eax, esi
pop esi
leave
ret 8
Function at 0x7cff8dd9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
mov dword [ebp - 4], ebx
je 0x7cff8f0f
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x7cff8f0f
mov ecx, ebx
lea edi, [ebp - 0x414]
call fcn.7cff3b96
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
cmp word [ebp - 0x414], 0x2e
jne 0x7cff8e76
cmp word [edi + 2], 0x2e
jne 0x7cff8e76
mov ax, word [edi + 4]
cmp ax, 0x5c
je 0x7cff8e6d
cmp ax, 0x2f
jne 0x7cff8e76
add edi, 6
cmp word [edi], 0x2e
je 0x7cff8e56
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x7cff8ed0
push esi
lea eax, [ebp - 0x20c]
push 0x7cf34b0c
push eax
call edi
mov ecx, dword [ebp - 4]
push 0x20
call fcn.7cff4380
test eax, eax
je 0x7cff8ec8
lea eax, [ebp - 0x20c]
push eax
call ebx
jmp 0x7cff8ecb
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x7cff8f0f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
test eax, eax
je 0x7cff8efe
cmp word [eax], 0
je 0x7cff8efe
add eax, 0xfffffffe
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7cff9e27
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
xor esi, esi
push edi
push esi
mov edi, 0x80004005
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x7cff9ea3
lea ecx, [ebp + 8]
push esi
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7cff9e98
lea eax, [ebp - 0x70]
push eax
call fcn.7d0428e0
push dword [ebp + 8]
lea eax, [ebp - 0x70]
push dword [ebp - 4]
push eax
call fcn.7d042910
lea eax, [ebp - 0x70]
push eax
call fcn.7d042a50
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [eax], ebx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7cff9ea8
mov edi, 0x8007000e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x7cffaeec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push edi
mov esi, ecx
push eax
mov edi, 0x80004005
push dword [esi + 0x28]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x7cffaf11
mov dword [ebp - 4], edi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
xor edi, edi
cmp eax, edi
mov dword [esi + 0x28], edi
jl 0x7cffaf3c
mov ecx, esi
call fcn.7cffbd79
push edi
mov ecx, esi
call fcn.7cffc700
cmp eax, edi
mov dword [ebp - 4], eax
jge 0x7cffaf6d
cmp eax, 0x8007000e
jne 0x7cffaf60
push 0x10
push 0x2760
push 0x268c
push dword [esi + 4]
push dword [0x7d04cdfc]
call sym.SHELL32.dll_ShellMessageBoxW
add esp, 0x14
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x7cffaf86
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push edi
push esi
push 0x7cffafd3
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x7cffbd1a
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0
push 0x3e9
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x3ea
push dword [esi + 4]
call edi
push eax
call ebx
push 0
mov ecx, esi
call fcn.7cffbc93
push 1
push 0x7cf32b54
mov ecx, esi
call fcn.7cffba30
push 0
push 0x3fc
push dword [esi + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x7cffbd79
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.7cffc812
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, eax
push ebp
push 0x3e9
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push ebp
push 0x3ea
push dword [esi + 4]
call edi
push eax
call ebx
push 5
push 0x3fc
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0
mov ebp, 0x404
push 0x466
push ebp
push dword [esi + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push ebp
push dword [esi + 4]
call edi
push eax
call ebx
add ebp, 0xffffffe4
push ebp
push dword [esi + 4]
call edi
push 5
push eax
call ebx
push ebp
push dword [esi + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x7cffcd76
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x2a2c]
lea edi, [ebp - 0x1c]
mov dword [ebp - 8], esi
mov eax, dword [ebx + 0x2a28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
push esi
call fcn.7cffcc8f
test eax, eax
mov dword [ebp + 8], eax
jne 0x7cffcdb8
mov eax, 0x80070057
jmp 0x7cffced0
mov edi, dword [ebp - 8]
mov dword [ebx + 0x2a28], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x7cffce0e
mov ecx, dword [ebp + 8]
mov edx, ebx
neg edx
mov eax, dword [ecx]
lea esi, [ebx + 0x4c]
sbb edx, edx
and edx, esi
push dword [edx]
call dword [eax]
test eax, eax
jne 0x7cffce07
mov edi, dword [ebp - 8]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2a28], eax
mov eax, 0x80004005
movsd dword es:[edi], dword [esi]
jmp 0x7cffced0
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0xc]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], esi
je 0x7cffce44
test esi, esi
je 0x7cffce3d
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x7cffce3d
push 0
push dword [esi + 0x34]
call edi
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x60]
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x7cffce8d
push 0xffffffffffffffff
mov ecx, ebx
call fcn.7cffd32d
mov ecx, dword [ebx + 0x2a28]
push 1
mov eax, dword [ecx]
call dword [eax + 0x60]
mov eax, dword [ebx + 0x2a28]
push 5
push dword [eax + 0x34]
call edi
mov eax, dword [ebx + 0x2a28]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [ebp + 0x10], 0
je 0x7cffce8d
mov ecx, dword [ebx + 0x2a28]
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp dword [ebp + 0xc], 0
je 0x7cffcece
mov ecx, ebx
call fcn.7cffd9f7
test eax, eax
je 0x7cffcece
lea ecx, [ebp + 8]
push ecx
push 0x7cf4ca10
push 0x7cf4ca20
push eax
call dword [sym.imp.SHLWAPI.dll_IUnknown_QueryService]
test eax, eax
jl 0x7cffcece
mov ecx, dword [ebx + 0x2a28]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x40]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7cffd7e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
cmp dword [esi + 4], 0x100
jne case.default.0x7cffd837
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je case.default.0x7cffd837
cmp dword [esi + 8], 0x11
je case.default.0x7cffd837
push 1
xor edi, edi
pop ebx
push 0x7cf43de4
push dword [esi]
call fcn.7cffca61
mov esi, dword [esi + 8]
push ebx
pop edx
lea ecx, [esi - 0x21]
cmp ecx, 7
ja case.default.0x7cffd837
jmp dword [ecx*4 + 0x7cffd8b1]
push 2
jmp 0x7cffd879
push 3
jmp 0x7cffd879
mov ecx, dword [ebp - 4]
push 4
pop eax
mov edi, dword [ecx + 0x2aac]
sub edi, dword [ecx + 0x2ab0]
jmp 0x7cffd87a
push 4
xor edi, edi
pop eax
jmp 0x7cffd87a
xor edx, edx
test eax, eax
sete dl
xor ebx, ebx
xor eax, eax
jmp 0x7cffd87a
xor edx, edx
test eax, eax
sete dl
xor ebx, ebx
push 1
pop eax
test edx, edx
je case.default.0x7cffd837
mov ecx, dword [ebp - 4]
cmp ebx, 1
jne 0x7cffd88f
cmp dword [ecx + 0x2aac], 0
jne 0x7cffd89b
test ebx, ebx
jne case.default.0x7cffd837
cmp dword [ecx + 0x2a90], ebx
je case.default.0x7cffd837
push edi
push eax
push ebx
call fcn.7cffd4fa
push 1
pop eax
jmp 0x7cffd8aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7cffd8d1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x7cffd8e9
cmp eax, 0x101
jne 0x7cffd945
push dword [esi]
call fcn.7cffd970
mov edi, eax
test edi, edi
je 0x7cffd907
push 0
push 0
push 0x157
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x7cf43de4
push dword [esi]
call fcn.7cffca61
cmp dword [esi + 8], 0x73
mov ebx, eax
jne 0x7cffd91f
test edi, edi
jne 0x7cffd945
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x7cffd956
test ebx, ebx
je 0x7cffd96b
mov esi, dword [esi + 8]
sub esi, 0x43
je 0x7cffd945
sub esi, 0x13
je 0x7cffd945
dec esi
dec esi
je 0x7cffd945
dec esi
dec esi
jne 0x7cffd96b
xor eax, eax
jmp 0x7cffd950
xor eax, eax
test ebx, ebx
sete al
pop edi
pop esi
pop ebx
ret 4
mov esi, dword [esi + 8]
cmp esi, 8
je 0x7cffd949
cmp esi, 0x70
jb 0x7cffd945
cmp esi, 0x87
ja 0x7cffd945
push 1
pop eax
jmp 0x7cffd950
Function at 0x7cffe5de
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 4], eax
test byte [ebp - 4], 1
je 0x7cffe6b6
xor edi, edi
push edi
push esi
call sym.SHELL32.dll_RealDriveType
cmp eax, 2
je 0x7cffe6b6
push edi
push esi
call sym.SHELL32.dll_RealDriveType
cmp eax, 4
je 0x7cffe6b6
mov eax, dword [0x7cf43e80]
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 0x18], eax
mov eax, dword [0x7cf43e84]
mov dword [ebp - 0x14], eax
lea eax, [esi + 0x41]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x18]
push edi
push eax
mov dword [ebp - 0x10], 0x104
call fcn.7cf830e8
test eax, eax
jne 0x7cffe6b6
push 0xe
lea edi, [ebp - 0x50]
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x3c
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.7cf8312c
test eax, eax
jl 0x7cffe6b6
cmp dword [ebp - 0x44], 0
jne 0x7cffe6c4
mov eax, dword [ebp - 0x38]
and eax, 0x10
test al, al
jne 0x7cffe6c4
test byte [ebp - 0x37], 0x60
jne 0x7cffe6c4
mov eax, dword [ebp - 0x38]
and eax, 0x20
test al, al
jne 0x7cffe6c4
shr dword [ebp - 4], 1
inc esi
cmp esi, 0x1a
jge 0x7cffe6cb
jmp 0x7cffe5f7
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x7cffe737
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
je 0x7cffe753
mov dword [esi], ebx
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x7cffe7dd
cmp esi, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, 0x7cf43e88
je 0x7cffe788
push 0x36
push edi
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x7cffe78c
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
test ebx, ebx
jne 0x7cffe7a4
push 4
push edi
push dword [ebp - 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x7cffe7a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x7cffe7d0
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x7cffe7be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x7cffe7c6
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
jmp 0x7cffe7e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov esi, eax
cmp esi, ebx
jle 0x7cffe7f8
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7cffe801
Capabilities:
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
neg esi
sbb esi, esi
xor edi, edi
and esi, 0xfffffff0
push 1
add esi, 0x20
push edi
push edi
or esi, 6
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x7cffe8ee
push esi
push 0x7cf43e88
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, edi
je 0x7cffe8db
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x7cffe8ca
cmp dword [ebp + 0xc], edi
je 0x7cffe879
mov eax, dword [ebp + 8]
push edi
push edi
push edi
neg eax
push edi
push edi
sbb eax, eax
push edi
push edi
add eax, 3
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [ebp + 8], edi
je 0x7cffe8b5
cmp dword [ebp - 0x1c], 7
je 0x7cffe8ad
cmp dword [ebp - 0x1c], 6
je 0x7cffe8ad
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x7cffe89b
xor esi, esi
jmp 0x7cffe8a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x420
jne 0x7cffe8d2
jmp 0x7cffe8c6
lea eax, [ebp - 0x20]
push eax
push 3
jmp 0x7cffe8bb
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x7cffe8ca
xor esi, esi
jmp 0x7cffe8d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7cffe8e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x7cffe8f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x7cffe906
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7d0021f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 8]
push esi
xor esi, esi
push eax
push 0x20006
add ecx, 0x240
push esi
push ecx
push ParseURLA
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x7d00227b
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2000000
push esi
push esi
push esi
push 0x7cf42cbc
mov dword [ebp - 4], esi
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
cmp ebx, esi
jne 0x7d002275
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 8]
push 1
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov ebx, eax
call edi
push dword [ebp - 8]
call edi
pop edi
mov eax, ebx
pop esi
neg eax
sbb eax, eax
pop ebx
and eax, 0x80004005
leave
ret 4