joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000783d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x10041c30
call fcn.10009a30
mov dword [ebp - 0x30], edx
mov ebx, ecx
xor esi, esi
test ebx, ebx
jne 0x1000785d
push esi
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10007874
push 0xc1
jmp 0x10007985
mov edi, dword [ebx + 0x3c]
cmp dword [edi + ebx], 0x4550
je 0x1000788a
push 0xbf
jmp 0x10007985
cmp word [edi + ebx + 0x14], si
je 0x10007980
mov edi, dword [edi + ebx + 0x78]
lea eax, [edi + ebx]
neg edi
sbb edi, edi
and edi, eax
mov dword [ebp - 0x28], edi
je 0x10007980
mov ecx, dword [edi + 0x1c]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x34], ecx
mov edx, dword [edi + 0x20]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x24], edx
mov eax, esi
mov dword [ebp - 0x1c], esi
cmp eax, dword [edi + 0x14]
jae 0x10007957
test ecx, ecx
je 0x100078f4
mov edx, dword [ecx + eax*4]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
jmp 0x100078f6
mov edx, esi
mov ecx, esi
mov eax, esi
mov dword [ebp - 0x20], esi
cmp eax, dword [edi + 0x18]
jae 0x10007927
mov edi, dword [ebp - 0x24]
movzx eax, word [edi + eax*2]
cmp eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
jne 0x1000794e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000794a
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x10]
add eax, dword [ebp - 0x1c]
push edx
push ecx
push eax
push dword [ebp - 0x30]
mov eax, 0x10006382
call eax
test eax, eax
je 0x10007957
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
jmp 0x100078dd
mov ecx, esi
jmp 0x10007927
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x100078fd
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x10007994
push 0xc0
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10010ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10010eaf
pop dword [ebp - 0x3c]
mov eax, 0x22937b3b
add eax, 0xed6d9374
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x42874
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x35452e44
add ecx, 0xcabb143e
mov edx, eax
mov ebx, 0xfc4a9152
sub ebx, 0xec45db52
add ebx, dword [ebp - 0x3c]
mov esi, 0x32493898
add esi, 0x495ff82d
mov edi, dword [ebx]
xor dword [ebp - 0x34], 0xee4ed41c
xor edi, esi
add dword [ebp - 0x30], edx
mov dword [edx], edi
add dword [ebp - 0x28], 0xee650120
add edx, 4
add ebx, 4
loop 0x10010f09
add eax, 0xc46df212
sub eax, 0xc46cf537
mov ebx, eax
add eax, 0xb6d585d8
sub eax, 0xb6d585d3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401b67
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ba6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ba6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ba6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ba6
cmp dword [ecx + 0x74], 0xe
jbe 0x401ba6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
add edx, eax
mov edx, 0xe8953ed
push 0x56
pop eax
aaa
sti
xchg esp, eax
sbb ebx, dword [edi + 0x41]
mov al, byte [0xa8ee25b1]
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x4194aa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4194e9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4194e9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4194e9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4194e9
cmp dword [ecx + 0x74], 0xe
jbe 0x4194e9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4107ab
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
mov eax, dword fs:[0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x42c000
mov dword [ebp - 0x48], 0x4d746547
mov dword [ebp - 0x44], 0x6c75646f
mov dword [ebp - 0x40], 0x6e614865
mov dword [ebp - 0x3c], 0x57656c64
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x58], 0x50746547
mov dword [ebp - 0x54], 0x41636f72
mov dword [ebp - 0x50], 0x65726464
mov dword [ebp - 0x4c], 0x7373
mov dword [ebp - 0x68], 0x74726956
mov dword [ebp - 0x64], 0x416c6175
mov dword [ebp - 0x60], 0x636f6c6c
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x78], 0x74726956
mov dword [ebp - 0x74], 0x506c6175
mov dword [ebp - 0x70], 0x65746f72
mov dword [ebp - 0x6c], 0x7463
mov dword [ebp - 0x88], 0x74726956
mov dword [ebp - 0x84], 0x516c6175
mov dword [ebp - 0x80], 0x79726575
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 5
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call fcn.004103e3
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 8]
call fcn.00410696
mov dword [ebp - 0xc], eax
mov eax, dword fs:[0]
mov ebx, dword [eax]
cmp ebx, 0xffffffff
je 0x4108d6
mov eax, ebx
jmp 0x4108cb
mov dword fs:[0], eax
mov ebx, dword fs:[0x30]
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
cmp eax, 0
je 0x410908
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 4]
jne 0x410904
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x18], ecx
jmp 0x410908
mov eax, dword [eax]
jmp 0x4108ef
wait
fninit
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0xc]
mov edx, eax
xor ecx, ecx
mov ebx, dword fs:[0x30]
call edx
leave
ret
Function at 0x10002e01
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10002e10
pop dword [ebp - 0x24]
mov eax, 0x355eb319
add eax, 0xdaa17af7
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd71d0087
add dword [ebp - 0x34], 0x773544c4
mov dword [ebp - 0x30], 0xc483d7a
add dword [ebp - 0x30], 0x25eb0ecb
mov dword [ebp - 0x2c], 0x477abee4
add dword [ebp - 0x2c], 0x4d1854a
mov dword [ebp - 0x28], 0x5e1409d0
add dword [ebp - 0x28], 0xa1ebf630
lea eax, [ebp - 0x34]
push eax
mov eax, 0xd90a1ac5
add eax, 0x36f640cb
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xd7baea8b
add dword [ebp - 0x34], 0x9cb77ecb
mov dword [ebp - 0x30], 0xc0a6d758
add dword [ebp - 0x30], 0x80c58a1d
mov dword [ebp - 0x2c], 0xc1150041
add dword [ebp - 0x2c], 0xa25a6c2b
mov dword [ebp - 0x28], 0x3337a5b4
add dword [ebp - 0x28], 0xccc85a4c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x35322
push 0
call eax
mov ecx, 0x428b
mov edx, eax
mov ebx, 0x1000b800
add ebx, dword [ebp - 0x24]
mov edi, 0x702d4479
sub edi, 0xf155ff12
add dword [ebp - 0x1c], edx
mov esi, dword [ebx]
xor dword [ebp - 0x14], 0xa3e7aae0
add esi, edi
add dword [ebp - 4], 0x645879af
mov dword [edx], esi
add edx, 0x1d55ce98
add edx, 0xe2aa316c
add ebx, 0x7c112617
sub ebx, 0x7c112613
loop 0x10002f21
add eax, 0xbaa626f3
sub eax, 0xbaa529f4
xor ebx, ebx
add ebx, eax
add eax, 0xa0e930d
add eax, 0xf5f16cf8
mov ecx, 0xd757130
add ecx, 0x28a8ed0
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10004550
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100045fd
cmp eax, 0x104
ja 0x100045fd
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call sub.MSVCR100.dll_memset
push esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x220]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [esp + 0x20c]
push ecx
call fcn.10030c90
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.1003779c
add esp, 0x414
ret
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
xor eax, eax
call fcn.1003779c
add esp, 0x414
ret
Function at 0x100049c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100394e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
xor eax, eax
mov word [edi], ax
mov dword [ebp - 4], eax
lea ecx, [ebp]
push ecx
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x10004a38
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030c90
lea edx, [ebp]
push edx
lea ecx, [ebp - 0x18]
call fcn.10002e00
cmp dword [eax], 0
je 0x10004a4f
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x10004a51
xor eax, eax
push 0x104
push eax
mov eax, dword [ebp + 0x218]
push eax
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.10002330
mov dword [ebp - 4], 0xffffffff
jmp 0x10004aa6
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003779c
lea esp, [ebp + 0x20c]
pop ebp
ret

Function at 0x10004ef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x218], eax
push str.JAVA_REGDEPLOY_DEBUG
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR100.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x10004fba
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
cmp dword [0x1004fba4], 0
jne 0x10004fd6
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x10004fba
test eax, eax
je 0x10004fba
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 4]
call fcn.10002e00
push str.JavaDeployReg.log
lea ecx, [esp + 8]
call fcn.10002e00
lea edx, [esp + 4]
push edx
lea ecx, [esp + 4]
call fcn.10004760
lea ecx, [esp + 4]
call fcn.10002330
mov eax, dword [esp]
test eax, eax
je 0x10004f98
mov eax, dword [eax]
jmp 0x10004f9a
xor eax, eax
push 0x1003b100
push eax
push 0x1004fba4
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
lea ecx, [esp]
test eax, eax
je 0x10004fd1
call fcn.10002330
xor eax, eax
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1003779c
add esp, 0x21c
ret
call fcn.10002330
mov ecx, dword [esp + 0x218]
xor ecx, esp
mov eax, 1
call fcn.1003779c
add esp, 0x21c
ret
Function at 0x10006a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100395c0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006afa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_LOCAL_APPDATA__NULL__0__szLocalPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030c90
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8

Function at 0x10006b70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100395f0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006bfa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_APPDATA__NULL__0__szLocalPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030c90
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006c50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8
Function at 0x10006c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039620
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006cfa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_COMMON_APPDATA__NULL__0__szPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030c90
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006d50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8
Function at 0x100087a0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x620], eax
test byte [0x1004fc04], 1
jne 0x100087db
or dword [0x1004fc04], 1
push 0x10039ab0
mov dword [0x1004fc00], 0
call fcn.10030c90
add esp, 4
mov eax, dword [0x1004fc00]
test eax, eax
je 0x100087f9
mov eax, dword [eax]
test eax, eax
je 0x100087f9
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x10008946
lea eax, [esp + 0x210]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x10008946
push esi
push edi
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0xc]
call fcn.10002e00
push str.jawshtml.html
lea ecx, [esp + 0x10]
call fcn.10006920
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.10004760
lea ecx, [esp + 0xc]
call fcn.10002330
mov edi, dword [esp + 8]
test edi, edi
je 0x1000885c
mov eax, dword [edi]
jmp 0x1000885e
xor eax, eax
push 0x1003c434
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
mov esi, eax
push esi
push str._HTML___HTML_
call dword [sym.imp.MSVCR100.dll_fputws]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
xor eax, eax
xor ecx, ecx
add esp, 0x14
mov word [esp + 0x10], ax
mov word [esp + 0x420], cx
test edi, edi
je 0x1000889b
mov edi, dword [edi]
jmp 0x1000889d
xor edi, edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x424]
push eax
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp eax, 0x20
jle 0x1000892a
lea eax, [esp + 0x10]
xor ecx, ecx
lea esi, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100088c0
sub eax, esi
sar eax, 1
cmp word [esp + 0x10], cx
je 0x100088f3
lea edx, [esp + 0x10]
lea ebx, [ebx]
cmp word [edx], 0x20
jne 0x100088f3
inc ecx
cmp word [esp + ecx*2 + 0x10], 0
lea edx, [esp + ecx*2 + 0x10]
jne 0x100088e0
cmp eax, ecx
jle 0x1000892a
lea edx, [esp + eax*2 + 0xe]
jmp 0x10008900
cmp word [edx], 0x20
jne 0x10008910
dec eax
sub edx, 2
cmp eax, ecx
jg 0x10008900
jmp 0x1000892a
cmp eax, ecx
jle 0x1000892a
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
lea eax, [esp + ecx*2 + 0x10]
push eax
mov ecx, 0x1004fc00
call fcn.10006f80
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.MSVCR100.dll__wremove]
add esp, 4
lea ecx, [esp + 8]
call fcn.10002330
pop edi
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
mov eax, 0x1004fc00
call fcn.1003779c
add esp, 0x624
ret
Function at 0x1000b160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x410
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x414]
push ebx
mov ebx, dword [esp + 0x420]
push esi
mov esi, dword [esp + 0x420]
push edi
push 2
push 0
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
call fcn.10030c90
mov edi, eax
test edi, edi
jne 0x1000b1bc
call fcn.100095a0
mov esi, eax
jmp 0x1000b25a
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000b1d2
call fcn.100095a0
jmp 0x1000b251
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x1000b1e7
call fcn.100095a0
jmp 0x1000b251
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000b1ff
mov esi, 0x8007000e
jmp 0x1000b253
push eax
lea ecx, [esp + 0x18]
call fcn.1000a400
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1000b218
mov esi, 0x8007000e
jmp 0x1000b253
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1000b231
call fcn.100095a0
jmp 0x1000b251
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [esp + 0x42c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.1000afd0
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea edx, [esp + 0x18]
cmp dword [esp + 0x14], edx
je 0x1000b270
lea ecx, [esp + 0x14]
call fcn.10009d00
lea ecx, [ecx]
mov ecx, dword [esp + 0x418]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1003779c
add esp, 0x410
ret 0x10

Function at 0x1000c100
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1000c15a
lea ecx, [esp + 4]
push ecx
push esi
call fcn.10002b30
add esp, 8
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1003779c
add esp, 0x20c
ret 8
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.1003779c
add esp, 0x20c
ret 8
Function at 0x1000ff60
Capabilities:
Initialize iwebbrowser2

Disassembly:
sub esp, 0x20
push edi
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x1000ff75
xor al, al
pop edi
add esp, 0x20
ret 0xc
push ebx
push ebp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x38]
push eax
push 0x1003d1cc
push 0x17
push 0
push 0x10046020
mov dword [esp + 0x4c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebp, eax
test ebp, ebp
js 0x10010044
push esi
mov esi, dword [esp + 0x34]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x64]
push edi
push esi
call edx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x2a4]
push 0
push edi
push esi
call ecx
lea edx, [esp + 0x10]
push edx
mov ebx, eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
push ebx
lea ecx, [esp + 0x24]
mov word [esp + 0x24], ax
call fcn.10030c90
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push edx
push edx
push edx
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2a8]
push ebx
push edi
push esi
mov ebp, eax
call edx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call ebx
test edi, edi
je 0x10010043
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
push edi
push esi
call eax
pop esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x38]
test ebp, ebp
setns bl
test eax, eax
je 0x1001005f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop ebp
mov al, bl
pop ebx
pop edi
add esp, 0x20
ret 0xc

Function at 0x10010cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x10010cd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10010d12
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10010d0e
lea ebx, [ebx]
cmp esi, eax
jae 0x10010d12
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10010d00
cmp esi, eax
jb 0x10010d18
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret