joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001d24
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10005080
cmp edx, dword [eax]
je 0x10001d46
add eax, 8
inc ecx
cmp eax, 0x10005110
jl 0x10001d37
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10005080]
jne 0x10001e74
mov eax, dword [0x100053a0]
cmp eax, 1
je 0x10001e4e
test eax, eax
jne 0x10001d77
cmp dword [0x100053a4], 1
je 0x10001e4e
cmp edx, 0xfc
je 0x10001e74
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10001dae
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.100020f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.100021e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10001df1
lea eax, [ebp - 0x1a4]
push eax
call fcn.100021e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100043ac
push edi
call fcn.10003260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.100020f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10002100
lea eax, [ebp - 0xa0]
push 0x1000438c
push eax
call fcn.10002100
push dword [esi + 0x10005084]
lea eax, [ebp - 0xa0]
push eax
call fcn.10002100
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.100031ce
add esp, 0x2c
pop edi
jmp 0x10001e74
lea eax, [ebp + 8]
lea esi, [esi + 0x10005084]
push 0
push eax
push dword [esi]
call fcn.100021e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4056f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
pushal
jne 0x4056ff
mov eax, dword [esi]
test eax, eax
je 0x405711
mov ecx, dword [eax]
mov dword [esi], ecx
push es
push eax
sub byte [edx - 1], dl
push eax
or byte [ebx - 0x263b5f16], cl
and al, al
jne 0x405759
pop esi
pop ebp
adc byte [eax - 0x6ffb6f70], dl
daa
nop
nop
nop
stosb byte es:[edi], al
nop
nop
or al, al
ret
mov esp, dword [edx + ebp*2 + 1]
push 0
push 0
push eax
call 0x2140a4b0
clc
jbe 0x40576a
add dword [eax], eax
je 0x405764
test dword [esi + 4], 0
fidiv dword [esi + 0x7d]
test esp, ebx
jne 0x405748
fisttp qword [ebx + 0x44624f3]
test eax, eax
je 0x405786
mov esi, ebx
and al, 0x46
add al, 0x85
sal byte [edx + edx + 0x18], 0xe
sbb byte [esi], cl
sub eax, dword [ecx]
lea eax, [eax]
cmp byte [edx - 5], ch
ror byte [ecx - 0x4a17fb82], 1
dec ebx
add byte [eax], al
mov esi, dword [esi + 8]
test esi, esi
jne 0x40576d
test edi, edi
je 0x405806
cmp ebp, dword [edi + 0x560000b7]
push ebx
mov dword [ebp - 4], esi
call 0x411560
jecxz 0x405817
or byte [ebx], dh
inc dword [ebx + 0x7502047e]
and ecx, dword [ebx + 0x6a016a16]
sbb al, 0x6a
add byte [edx - 0x18], dl
test dword [ebx - 0x42], 0x10c763d
add byte [ebp + 7], dh
mov edi, 0xc30036
jmp 0x4057ce
mov esi, dword [esi + 8]
test esi, esi
jne 0x40584c
test edi, edi
je 0x405803
mov esi, dword [ebp - 4]
test dword [ebp + 0x7f], ecx
mov edi, 0x27fc0842
rol dh, 0x8b
add byte [ebx + 0x19], dh
push esi
push ebx
call 0x7c3b6d14
push cs
add byte [edx + 0x76], ch
push esi
cld
call fcn.0040b540
mov ebx, eax
mov dword [ebp - 4], edx
jmp 0x4057a0
push 0x5d
or byte [ebx + 0x47e83f3], cl
add dh, byte [ebp + 0xa]
mov esi, ebx
cmp dword [esi + 4], 2
jne 0x405818
mov eax, dword [esi]
push 9
push eax
call 0xa24071d0
mov byte [0x8508768b], al
rol bh, 0xe9
imul esi, ebx, 0x8504468b
sal byte [esi + ecx - 0x75], 0xe
mov esi, dword [esi + 8]
test eax, eax
invalid
mov eax, dword [esi + 4]
test eax, eax
je 0x405836
mov ecx, dword [esi]
call 0x6a408d2f
add byte [ecx - 0x18], dl
jp 0x405880
add byte [eax - 0x75], ch
xor cl, byte [eax]
test esi, esi
jne 0x405821
mov esi, dword [edx]
or byte [ebp - 0x3a1b8a0a], al
pop edi
pop ebx
lds ebx, [edi + 0x5b]
mov esp, ebp
pop ebp
ret
nop
nop
nop
nop

Function at 0x40a940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb dl, byte [ebp + 0x1f9db435]
movsb byte es:[edi], byte [esi]
mov esp, 0xeb49cc75
or byte [esi + 0x6b4b602f], bh
add byte [edi - 0x29], ah
Function at 0x4612d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4614a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x46148d
mov eax, dword [edi + 0x30]
call fcn.004042a4
test eax, eax
jne 0x461326
mov eax, dword [edi + 0x34]
call fcn.004042a4
test eax, eax
jne 0x461326
mov eax, edi
call fcn.00461544
jmp 0x46148d
cmp dword [edi + 0xa0], 0
jne 0x46135d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.004086e8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x475be8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x461394
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.004086e8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x475be8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00461584
mov ebx, eax
test bl, bl
jne 0x461442
mov eax, dword [edi + 0x30]
call fcn.004042a4
test eax, eax
jne 0x4613cc
mov eax, dword [edi + 0xc0]
call fcn.004042a4
test eax, eax
je 0x461442
mov eax, dword [edi + 0xc0]
call fcn.004042a4
test eax, eax
je 0x4613ee
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.004086e8
jmp 0x46141a
push dword [edi + 0x30]
push 0x4614c0
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404364
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.004086e8
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x461442
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00461584
mov ebx, eax
test bl, bl
jne 0x46144f
mov eax, edi
call fcn.00461544
jmp 0x46148d
mov eax, dword [edi + 0x58]
test eax, eax
je 0x46145e
mov dword [edi + 0xa8], eax
jmp 0x461468
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.004615fc
test al, al
je 0x46148d
mov eax, edi
mov si, 0xffee
call fcn.00403490
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004616a8
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4614ad
lea eax, [ebp - 0x108]
call fcn.00403fe4
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7cfd01be
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..pdata_1
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5ddb44c2
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100011b4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x104
call fcn.100022da
mov ecx, esi
push dword [ebp + 8]
call fcn.10002352
mov ecx, esi
call fcn.10002502
mov edi, eax
mov ecx, esi
call fcn.100024ee
cmp eax, 3
jb 0x1000122a
movzx eax, word [edi + 2]
cmp ax, 0x3a
jne 0x1000121a
cmp word [edi + 4], 0x5c
jne 0x1000122a
movzx eax, word [edi]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x1000122a
jmp 0x100012bc
cmp word [edi], 0x5c
jne 0x1000122a
cmp ax, 0x5c
je 0x100012bc
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x1c]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.10002264
push edi
push 0
call fcn.1000110f
add esp, 8
test eax, eax
js 0x100012f4
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.100024ee
mov ebx, eax
mov ecx, edi
call fcn.10002502
mov ecx, esi
push ebx
push eax
call fcn.1000237c
mov ecx, edi
call fcn.10002502
push 0x5c
push eax
call fcn.10160cc1
add esp, 8
test eax, eax
je 0x10001303
mov ebx, eax
lea edi, [ebp - 0x1c]
mov ecx, edi
call fcn.10002502
sub ebx, eax
add ebx, 2
sar ebx, 1
mov ecx, edi
call fcn.10002502
mov ecx, esi
push ebx
push eax
call fcn.1000237c
mov ecx, esi
push dword [ebp + 8]
call fcn.10002422
mov ecx, edi
call fcn.10002278
xor edi, edi
push esi
call fcn.1000104a
add esp, 4
test al, al
jne 0x10001310
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_Failed_to_find_the_WebView2_client_dll_at:
call edi
mov ecx, esi
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10193116
call edi
mov edi, 0x80070002
jmp 0x10001310
mov edi, eax
push str.WebView2:_Failed_to_find_the_app_exe_path._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10001308
mov edi, 0x80004005
lea ecx, [ebp - 0x1c]
call fcn.10002278
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecc3
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001fe7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x230
mov edi, edx
mov esi, ecx
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [esp + 0x228], eax
lea eax, [esp + 0x20]
push 0x208
push 0xff
push eax
call fcn.10160d70
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
mov dword [eax], 0xffffffff
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
sub ecx, edi
push eax
push 0x20219
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x100020e4
lea eax, [esp + 0xc]
push eax
lea edi, [esp + 0x24]
push edi
push ebx
push ebx
push str.EBWebView
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100020e2
cmp dword [esp + 0xc], 3
mov ebx, 0
jb 0x100020e4
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.10002352
mov ecx, esi
call fcn.10002502
push 0x5c
push eax
call fcn.10160cc1
add esp, 8
test eax, eax
je 0x100020e2
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [esp + 0x10]
movdqa xmmword [edx], xmm0
mov ecx, edi
call fcn.10001e94
test al, al
je 0x100020e2
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100020d3
push edi
call fcn.10002352
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.100020fc
mov ebx, eax
jmp 0x100020e4
xor ebx, ebx
mov ecx, dword [esp + 0x228]
xor ecx, ebp
call fcn.1015ecc3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100020fc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x10193498]
cmp dword [ecx + eax], edx
ja 0x1000211a
jb 0x10002125
add eax, 4
cmp eax, 0x10
jne 0x10002105
push esi
call fcn.1000104a
add esp, 4
jmp 0x10002149
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WebView2:_skipped_an_incompatible_version
call edi
mov ecx, esi
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10193116
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x10002a46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x10002ac1
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10002adb
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.10002b05
add esp, 8
test al, al
je 0x10002aeb
mov eax, dword [esi]
test eax, eax
je 0x10002b01
push 0xa
push 0
push eax
call fcn.10168da0
add esp, 0xc
cmp eax, 1
jmp 0x10002adf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecc3
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10002b05
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x10002aed
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecc3
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x10002ae2

Function at 0x10002b05
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.10160d70
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x10002b7c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.10002352
mov ecx, edi
call fcn.10002502
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecc3
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002c24
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x101ece94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10002c82
mov edi, eax
push str.CreateWebViewEnvironmentWithOptionsInternal
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002cf8
mov ecx, eax
mov esi, dword [ebp + 0x1c]
mov bl, byte [ebp + 0xc]
call dword [0x10192a68]
movzx eax, bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call ecx
mov esi, eax
mov dword [ebp - 0x14], eax
jmp 0x10002d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
pcmpeqd xmm0, xmm0
lea edi, [ebp - 0x20]
movq qword [edi], xmm0
mov dword [edi + 8], 0xffffffff
mov ecx, edi
call fcn.10002264
push edi
push 1
push 4
push ebx
call fcn.10002b98
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
call ebx
mov ecx, edi
call fcn.10002502
push eax
call ebx
push str._path
call ebx
push dword [ebp + 8]
call ebx
push 0x10193852
call ebx
mov ecx, edi
call fcn.10002278
jmp 0x10002d7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], esi
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x20]
movq qword [ebx], xmm0
mov dword [ebx + 8], 0xffffffff
mov ecx, ebx
call fcn.10002264
push ebx
push 1
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.10002b98
add esp, 0x10
push str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call fcn.10002502
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10193852
call eax
mov ecx, ebx
call fcn.10002278
push str.DllCanUnloadNow
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002d7e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015ecc3
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10005d5a
Capabilities:
Get graphical window text

Disassembly:
push 0x228
mov eax, 0x10180102
call fcn.1015f9a4
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], esi
push 0x101c86f6
mov dword [ebx], esi
call fcn.10004da4
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x21c]
push str.Chrome_WidgetWin_1
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x21c], esi
call fcn.10004da4
push esi
mov dword [ebp - 4], 1
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_FindWindowA]
jmp 0x10005ef0
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x10005ee7
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10005ee7
push 0x104
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.10160d70
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005e16
sub ecx, edx
je 0x10005ee7
push 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10160d70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10004da4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
push dword [eax - 0xc]
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.10004ea9
mov byte [ebp - 4], 3
mov ecx, eax
push dword [ebp - 0x21c]
call fcn.10004f2e
mov byte [ebp - 4], 2
mov esi, eax
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.10003bf1
test esi, esi
jne 0x10005ed3
push esi
push ecx
mov ecx, esp
mov byte [ebp - 0x221], 0x3b
push ecx
mov edx, edi
call fcn.10008729
mov dl, byte [ebp - 0x221]
pop ecx
mov ecx, ebx
call fcn.10008308
pop ecx
pop ecx
jmp 0x10005ed5
xor esi, esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x10005dc7
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, ebx
call fcn.1015f953
ret 4
Function at 0x100074f0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
xor esi, esi
mov al, byte [edi]
test al, al
je 0x10007596
push ebx
movsx eax, al
mov ebx, dword [eax*4 + 0x101c89d0]
cmp ebx, 0xffffffff
je 0x1000758a
mov eax, esi
sub eax, 0
je 0x10007585
sub eax, 1
je 0x10007565
sub eax, 1
je 0x10007546
sub eax, 1
jne 0x10007588
cmp ecx, 0xdbba0
jge 0x10007542
mov eax, dword [ebp + 0xc]
shl dl, 6
or dl, bl
mov byte [ecx + eax], dl
inc ecx
xor esi, esi
jmp 0x10007588
cmp ecx, 0xdbba0
jge 0x10007561
mov eax, ebx
shl dl, 4
sar eax, 2
and al, 0xf
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 3
jmp 0x10007582
cmp ecx, 0xdbba0
jge 0x10007580
mov eax, ebx
shl dl, 2
sar eax, 4
and al, 3
or al, dl
mov edx, dword [ebp + 0xc]
mov byte [ecx + edx], al
inc ecx
push 2
pop esi
jmp 0x10007588
xor esi, esi
inc esi
mov edx, ebx
inc edi
mov al, byte [edi]
test al, al
jne 0x10007509
pop ebx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
Function at 0x100079ce
Capabilities:
Get common file path

Disassembly:
push 0x810
mov eax, 0x1018073f
call fcn.1015f9a4
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x81c], edi
push 0x800
xor ebx, ebx
mov dword [ebp - 0x81c], edi
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.10160d70
add esp, 0xc
mov dword [ebp - 0x814], ebx
call fcn.10017b67
push eax
lea ecx, [ebp - 0x814]
call fcn.10005087
mov dword [ebp - 4], ebx
sub esi, 1
je 0x10007b0c
sub esi, 1
je 0x10007b04
sub esi, 3
je 0x10007afd
sub esi, 4
je 0x10007a71
sub esi, 1
je 0x10007a6c
sub esi, 1
je 0x10007a67
sub esi, 1
jne 0x10007b3e
push ebx
push 0x1c
lea eax, [ebp - 0x810]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x10007b1e
push ebx
push 0x23
jmp 0x10007a54
push ebx
push 0x1a
jmp 0x10007a54
push 1
push 2
pop edx
lea ecx, [ebp - 0x818]
call fcn.100079ce
mov byte [ebp - 4], 1
mov dword [esp], str.Links
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.10004c52
add esp, 0xc
push eax
lea ecx, [ebp - 0x814]
mov byte [ebp - 4], 2
call fcn.10005037
mov ecx, dword [ebp - 0x81c]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
add ecx, 0xfffffff0
call fcn.10003bf1
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.100050e8
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.100078cd
pop ecx
mov byte [ebp - 4], 3
jmp 0x10007b6e
push ebx
push ebx
jmp 0x10007a54
push ebx
push 6
jmp 0x10007a54
lea eax, [ebp - 0x810]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x810]
push eax
call fcn.1000501d
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.1000520a
push ecx
mov esi, esp
mov dword [ebp - 0x818], esi
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
push eax
call fcn.100050e8
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x818]
mov edx, ebx
mov dword [esi], eax
call fcn.100078cd
pop ecx
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x814]
call fcn.10005037
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x818]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov esi, dword [ebp - 0x814]
add esi, 0xfffffff0
push esi
call fcn.100050e8
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10003bf1
mov eax, edi
call fcn.1015f953
ret