joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100266dd
Capabilities:
Create thread
Resume thread

Disassembly:
push 0
mov eax, 0x1017bd33
call fcn.10145d80
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
mov dword [ebp - 4], 1
je 0x100267c1
cmp dword [esi + 8], ebx
je 0x100267c1
push 0x14
call fcn.10146645
cmp eax, ebx
pop ecx
je 0x1002671d
mov ecx, eax
call fcn.10026226
mov edi, eax
jmp 0x1002671f
xor edi, edi
cmp edi, ebx
je 0x100267ad
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, dword [esi + 8]
mov dword [edi + 4], eax
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 8]
call fcn.10007845
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.10007845
mov ax, word [ebp + 0x10]
mov word [edi + 0x10], ax
xor eax, eax
cmp dword [ebp + 0x14], eax
je 0x1002679a
lea ecx, [ebp + 0x10]
push ecx
push 4
push edi
push fcn.100265a6
push eax
push eax
call fcn.10147cdf
mov edi, eax
add esp, 0x18
test edi, edi
je 0x100267ad
and dword [esi + 4], ebx
and dword [esi + 8], ebx
push 0x4000
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x100267ad
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.100265a6
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
lea ecx, [ebp + 8]
call fcn.10003b75
lea ecx, [ebp + 0xc]
call fcn.10003b75
mov eax, ebx
jmp 0x100267d3
lea ecx, [ebp + 8]
call fcn.10003b75
lea ecx, [ebp + 0xc]
call fcn.10003b75
xor eax, eax
call fcn.10145e58
ret 0x10
Function at 0x100267db
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x1017bd66
call fcn.10145de9
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x30], ecx
xor eax, eax
xor edx, edx
cmp ecx, edx
mov byte [ebp - 0x24], dl
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], edx
stosb byte es:[edi], al
mov dword [ebp - 0x34], edx
je 0x10026975
cmp dword [ebp + 0x10], edx
jbe 0x10026975
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x12], 0x38
call fcn.10007ade
mov esi, 0x101a2cac
xor ebx, ebx
push esi
inc ebx
push 0x1019fce4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.10011220
push esi
push 0x101a05b8
lea ecx, [ebp - 0x2c]
call fcn.10011220
push str._BARXLOG_MUTEX
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10007b6e
push dword [eax]
xor edi, edi
push edi
mov ecx, 0x101f8c68
mov byte [ebp - 4], 2
call fcn.10016a0b
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp - 0x38]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.10003b75
cmp esi, edi
je 0x1002696d
push 0xffffffffffffffff
push esi
mov byte [ebp - 0x11], 0x35
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x10026966
push 0x101a2c84
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x13], 0x32
mov dword [ebp - 0x28], edi
call fcn.10147b95
add esp, 0xc
test eax, eax
jne 0x1002695f
cmp dword [ebp - 0x28], edi
je 0x1002695f
push 0xa0
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x10]
mov byte [ebp - 0x24], 0x39
push dword [ebp - 0x30]
mov byte [ebp - 0x23], 0x45
mov byte [ebp - 0x22], 0x41
mov byte [ebp - 0x21], 0x41
mov byte [ebp - 0x20], 0x37
mov byte [ebp - 0x1f], 0x35
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x38
mov byte [ebp - 0x1c], 0x42
mov byte [ebp - 0x1b], 0x33
mov byte [ebp - 0x1a], 0x46
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x34
mov byte [ebp - 0x17], 0x42
mov byte [ebp - 0x16], 0x35
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x41
call fcn.10073949
push dword [ebp - 0x28]
lea eax, [ebp + 0x10]
push ebx
push 4
push eax
call fcn.10148a8b
add esp, 0x20
cmp eax, ebx
jne 0x10026956
push dword [ebp - 0x28]
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x30]
call fcn.10148a8b
add esp, 0x10
cmp eax, ebx
jne 0x10026956
mov dword [ebp - 0x34], ebx
push dword [ebp - 0x28]
call fcn.101475da
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.10003b75
lea ecx, [ebp + 8]
call fcn.10003b75
mov eax, dword [ebp - 0x34]
call fcn.10145e6c
ret
Function at 0x10026c3e
Capabilities:
Create thread
Resume thread

Disassembly:
push 4
mov eax, 0x1017bdce
call fcn.10145d80
push 0x1c
mov dword [ebp - 4], 2
xor edi, edi
call fcn.10146645
cmp eax, edi
pop ecx
je 0x10026c6a
mov ecx, eax
call fcn.100261f8
mov esi, eax
jmp 0x10026c6c
xor esi, esi
cmp esi, edi
je 0x10026cfe
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.10007845
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 4]
call fcn.10007845
lea eax, [ebp + 0x10]
push eax
lea ecx, [esi + 8]
call fcn.10007845
cmp dword [ebp + 0x20], edi
mov ax, word [ebp + 0x1c]
mov word [esi + 0xc], ax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x14], eax
je 0x10026cf1
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push fcn.10026986
push edi
push edi
call fcn.10147cdf
mov esi, eax
add esp, 0x18
cmp esi, edi
je 0x10026cfe
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc edi
jmp 0x10026cfe
push esi
call fcn.10026986
mov edi, eax
neg edi
sbb edi, edi
inc edi
lea ecx, [ebp + 8]
call fcn.10003b75
lea ecx, [ebp + 0xc]
call fcn.10003b75
lea ecx, [ebp + 0x10]
call fcn.10003b75
mov eax, edi
call fcn.10145e58
ret
Function at 0x10029e41
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
lea ebp, [esp - 0x1f9c]
mov eax, 0x201c
call fcn.10146c50
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x1f98], eax
mov eax, dword [ebp + 0x1fac]
push ebx
push esi
mov esi, dword [ebp + 0x1fa4]
push edi
mov edi, dword [ebp + 0x1fa8]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.sobar_post
mov dword [ebp - 0x78], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp eax, ebx
mov dword [ebp - 0x6c], eax
jne 0x10029e97
xor eax, eax
jmp 0x10029f8c
mov esi, dword [esi]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x80], esi
jne 0x10029ebd
push dword [ebp - 0x6c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x10029e90
mov edi, dword [edi]
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push str.POST
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
cmp eax, ebx
mov dword [ebp - 0x70], eax
jne 0x10029ee8
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x6c]
call esi
jmp 0x10029e90
push dword [ebp + 0x1fb0]
push dword [ebp - 0x78]
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestW]
mov esi, 0xfff
push esi
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push 1
push dword [ebp - 0x70]
lea edi, [esi + 1]
mov dword [ebp - 0x74], edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
push esi
lea eax, [ebp + 0xf99]
push ebx
push eax
mov byte [ebp + 0xf98], bl
call fcn.10146c80
push edi
lea eax, [ebp + 0xf98]
push eax
push dword [ebp - 0x70]
call fcn.1011ae7b
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
add esp, 0x18
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x80]
call esi
push dword [ebp - 0x6c]
call esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xf98]
push 0x101a2f64
push eax
call fcn.101490af
mov ecx, dword [ebp + 0x1fb0]
xor eax, eax
add esp, 0xc
cmp dword [ebp - 0x7c], ecx
sete al
mov ecx, dword [ebp + 0x1f98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10145d71
add ebp, 0x1f9c
leave
ret
Function at 0x1002b10e
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x14
mov eax, 0x1017ca41
call fcn.10145d80
mov ecx, 0x101f7e14
call fcn.10024521
mov eax, dword [0x101f3028]
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov esi, 0x104
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.1000401e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.100041f7
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str._srp__d
push eax
call fcn.10004662
mov eax, dword [0x101f3028]
mov dword [ebp - 0x1c], eax
push 0
mov byte [ebp - 4], 2
call fcn.10146fd5
push eax
push str.http:__toolbar.baidu.com_update_rp
lea eax, [ebp - 0x1c]
push str._s_t_d
push eax
call fcn.10004662
add esp, 0x24
push 1
push 0x4e20
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.10007ade
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 3
call fcn.10007ade
mov byte [ebp - 4], 2
call fcn.1011af35
add esp, 0x10
test eax, eax
je 0x1002b23e
mov eax, dword [0x101f3028]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 4
call esi
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push str._srp_dat__d
push eax
call fcn.10004662
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10073800
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x18
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002b236
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.10007ade
mov ecx, dword [ebp + 8]
call fcn.1002a76b
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
lea ecx, [ebp - 0x18]
call fcn.10003b75
call fcn.10145e58
ret 4

Function at 0x1002b52c
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
mov ebx, ecx
call fcn.10146fd5
pop ecx
mov esi, 0x101f84e8
mov ecx, esi
mov edi, eax
call fcn.10054190
mov ecx, edi
sub ecx, eax
cmp ecx, 0x15180
jl 0x1002b592
push edi
mov ecx, esi
call fcn.100541ba
lea eax, [esp + 0xc]
push eax
push 4
push ebx
push 0x1002b25e
push 0
push 0
call fcn.10147cdf
mov esi, eax
add esp, 0x18
test esi, esi
je 0x1002b592
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1002b80f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002b877
cmp dword [ebp + 0x10], 1
je 0x1002b850
cmp dword [ebp + 0x10], 2
je 0x1002b850
push 0xd
pop eax
jmp 0x1002b877
test edi, edi
mov eax, dword [ebp - 4]
je 0x1002b871
test eax, eax
je 0x1002b86d
test al, 1
jne 0x1002b84b
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x1002b871
jmp 0x1002b84b
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x1002bad3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
lea esi, [ecx + 4]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
add edx, eax
push 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], edi
add edi, ecx
push eax
push 0
mov ecx, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], edi
call fcn.1002b8f5
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
leave
ret 8
Function at 0x1002d74d
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp fcn.1002d64a
Function at 0x1002eaf1
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10

Function at 0x1002f9cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x5c], 0
je 0x1002fa04
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, esi
call fcn.1002f96e
pop esi
leave
ret

Function at 0x1002fa07
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
lea edx, [esp + 4]
push edx
push 0
mov esi, ecx
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
push 8
push 0
call dword [eax]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0x58], 0
mov ecx, esi
call fcn.1002f782
push 0x67
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
pop esi
pop ecx
ret

Function at 0x100320e4
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x1017d022
call fcn.10145de9
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax - 8], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
jne 0x10032119
call fcn.10003b75
xor eax, eax
lea esp, [ebp - 0x22c]
call fcn.10145e6c
ret
push ebx
call fcn.1000401e
cmp eax, ebx
mov dword [ebp - 0x21c], eax
je 0x10032138
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1003213c
xor esi, esi
jmp 0x10032158
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push dword [ebp - 0x21c]
push eax
call fcn.1000ff6e
mov esi, eax
mov ecx, esi
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003215d
sub ecx, eax
push ecx
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.10121795
add esp, 0xc
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10007845
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.10003b75
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call fcn.10146c80
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
ja 0x100321d9
mov ecx, edi
call fcn.100116a5
lea ecx, [ebp + 8]
call fcn.10003b75
mov eax, ebx
jmp 0x1003210d
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1000ed2f
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.10007845
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.10003b75
push 0x101a34bc
mov ecx, edi
call fcn.1001107f
xor ebx, ebx
inc ebx
jmp 0x100321ca
Function at 0x10032218
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x1017d068
call fcn.10145de9
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
jne 0x10032249
call fcn.10003b75
xor eax, eax
call fcn.10145e6c
ret
add eax, eax
cmp eax, ebx
je 0x1003223c
push eax
push ebx
call fcn.1000401e
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10121795
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10007845
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.10003b75
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call fcn.10146c80
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
jg 0x100322c8
mov ecx, esi
call fcn.100116a5
lea ecx, [ebp + 8]
call fcn.10003b75
mov eax, ebx
jmp 0x10032243
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1000ed2f
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10007845
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.10003b75
push 0x101a34c4
mov ecx, esi
call fcn.1001107f
xor ebx, ebx
inc ebx
jmp 0x100322b9
Function at 0x10035ea1
Capabilities:
Create thread

Disassembly:
push 0x1c
mov eax, 0x1017d980
call fcn.10145d80
mov esi, ecx
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.100116a5
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x101a0944
push ebx
mov dword [ebp - 4], ebx
call fcn.10119348
add esp, 0x10
cmp eax, ebx
jne 0x10035f30
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x10035f30
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x20]
cmp dword [ebp - 0x1c], ebx
je 0x10035f30
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
mov byte [ebp - 4], 1
call dword [ecx + 0x24]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.10007b11
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.10007845
lea ecx, [ebp - 0x18]
call fcn.10003b75
push dword [ebp - 0x14]
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [esi + 0x1c]
call fcn.100116a5
lea ecx, [esi + 0x20]
call fcn.100116a5
lea ecx, [esi + 0x24]
call fcn.100116a5
lea ecx, [esi + 0x2c]
call fcn.100116a5
lea ecx, [esi + 0x34]
mov dword [esi + 0x30], ebx
call fcn.10033f83
lea ecx, [esi + 0x44]
mov dword [ebp - 0x18], ecx
call fcn.10033b99
lea ecx, [esi + 0x54]
mov dword [ebp - 0x20], ecx
call fcn.10033be7
lea ecx, [esi + 0x64]
mov dword [ebp - 0x24], ecx
call fcn.10033c35
mov eax, dword [edi]
mov dword [esi + 0x74], 1
cmp dword [eax - 8], ebx
je 0x10035fbf
mov ecx, esi
call fcn.10035a53
test eax, eax
jne 0x10035fbf
push ebx
push ebx
push esi
push 0x10035e34
push ebx
push ebx
mov dword [esi + 0x74], ebx
call fcn.10147cdf
add esp, 0x18
mov esi, eax
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x28], esp
push dword [ebp - 0x18]
call fcn.10033e16
call fcn.1007dbbf
mov ecx, esp
mov dword [ebp - 0x28], esp
push dword [ebp - 0x20]
call fcn.10033e8e
call fcn.1007dc6e
mov ecx, esp
mov dword [ebp - 0x28], esp
push dword [ebp - 0x24]
call fcn.10033f06
call fcn.1007dd1d
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add esp, 0x10
cmp eax, ebx
je 0x1003600c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.10145e58
ret
Function at 0x1003b492
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [esi + 4], ebx
jle 0x1003b52d
push edi
mov edi, 0x101f8c08
push ebx
mov ecx, esi
call fcn.1003b08e
mov eax, dword [eax]
mov ecx, dword [esi + 0x10]
push 0x3e8
push eax
push ecx
mov ecx, edi
call fcn.10016a41
push eax
call fcn.1011fdff
add esp, 0x10
cmp eax, 1
push ebx
mov ecx, esi
jne 0x1003b50c
mov dword [ebp - 4], 2
call fcn.1003b08e
mov eax, dword [eax]
mov ecx, dword [esi + 0x10]
push 4
lea edx, [ebp - 4]
push edx
push 4
push eax
push ecx
mov ecx, edi
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x1003b526
call fcn.1003b08e
mov eax, dword [eax]
mov ecx, dword [esi + 0x10]
push eax
push ecx
mov ecx, edi
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
inc ebx
cmp ebx, dword [esi + 4]
jl 0x1003b4b5
pop edi
mov ecx, esi
call fcn.1003b37a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
leave
ret
Function at 0x1003d5f8
Capabilities:
Create process on windows

Disassembly:
push 0x14
mov eax, 0x1017e89d
call fcn.10145d80
xor esi, esi
mov dword [ebp - 0x1c], esi
call fcn.1011be11
test eax, eax
je 0x1003d6b2
lea eax, [ebp - 0x1c]
push eax
call fcn.101269d4
mov dword [esp], 0x101a43b0
push 0xa
call fcn.10104e0d
mov ebx, 0x178
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.10121817
mov eax, dword [eax]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0x10
push 5
push esi
push eax
push str.iexplore
push esi
push esi
call edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.10003b75
cmp dword [ebp - 0x18], 0x20
jg 0x1003d776
lea eax, [ebp - 0x14]
push eax
call fcn.1011ddb9
push dword [ebp - 0x14]
mov dword [ebp - 4], esi
push 0x101a4340
push 0xa
call fcn.10104e0d
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.10121817
add esp, 0x18
push 5
push esi
push dword [eax]
push dword [ebp - 0x14]
push esi
push esi
call edi
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
jmp 0x1003d776
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], esi
call fcn.1007a762
pop ecx
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x1003d776
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.100e53b3
cmp dword [ebp - 0x10], esi
je 0x1003d776
lea eax, [ebp - 0x20]
push eax
call fcn.101173de
mov eax, dword [eax]
cmp eax, esi
pop ecx
je 0x1003d70c
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10004f20
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x1003d719
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, esi
je 0x1003d765
lea eax, [ebp - 0x20]
push 0x178
push eax
call fcn.10121817
mov eax, dword [eax]
push esi
push eax
push edi
mov byte [ebp - 4], 3
call fcn.10117d2f
add esp, 0x14
lea ecx, [ebp - 0x20]
mov ebx, eax
call fcn.10003b75
mov eax, dword [edi]
push edi
mov byte [ebp - 4], 1
call dword [eax + 8]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, esi
je 0x1003d761
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
jmp 0x1003d778
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, esi
je 0x1003d776
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
call fcn.10145e58
ret 0x10

Function at 0x1003e46b
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 4]
jne 0x1003e47f
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1003e499
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1003fe1d
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x2c], 0
je 0x1003fe2c
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 1
mov ecx, esi
call fcn.1003fdbc
lea ecx, [esi + 0x144]
pop esi
jmp fcn.1003fc87