joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x72
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xec], 0x740068
mov dword [ebp - 0xe8], 0x700074
mov dword [ebp - 0xe4], 0x2f003a
mov dword [ebp - 0xe0], 0x25002f
mov dword [ebp - 0xdc], 0x2f0073
mov dword [ebp - 0xd8], 0x730025
mov dword [ebp - 0xd4], 0x70003f
mov dword [ebp - 0xd0], 0x640069
mov dword [ebp - 0xcc], 0x7b003d
mov dword [ebp - 0xc8], 0x690070
mov dword [ebp - 0xc4], 0x7d0064
mov dword [ebp - 0xc0], 0x740026
mov dword [ebp - 0xbc], 0x700079
mov dword [ebp - 0xb8], 0x3d0065
mov dword [ebp - 0xb4], 0x74007b
mov dword [ebp - 0xb0], 0x700079
mov dword [ebp - 0xac], 0x7d0065
mov dword [ebp - 0xa8], 0x610026
mov dword [ebp - 0xa4], 0x740063
mov dword [ebp - 0xa0], 0x6f0069
mov dword [ebp - 0x9c], 0x3d006e
mov dword [ebp - 0x98], 0x61007b
mov dword [ebp - 0x94], 0x740063
mov dword [ebp - 0x90], 0x6f0069
mov dword [ebp - 0x8c], 0x7d006e
mov dword [ebp - 0x88], 0x610026
mov dword [ebp - 0x84], 0x700070
mov dword [ebp - 0x80], 0x7b003d
mov dword [ebp - 0x7c], 0x700061
mov dword [ebp - 0x78], 0x7d0070
mov dword [ebp - 0x74], 0x610026
mov dword [ebp - 0x70], 0x700070
mov dword [ebp - 0x6c], 0x650076
mov dword [ebp - 0x68], 0x3d0072
mov dword [ebp - 0x64], 0x61007b
mov dword [ebp - 0x60], 0x700070
mov dword [ebp - 0x5c], 0x650076
mov dword [ebp - 0x58], 0x7d0072
mov dword [ebp - 0x54], 0x6d0026
mov dword [ebp - 0x50], 0x640069
mov dword [ebp - 0x4c], 0x7b003d
mov dword [ebp - 0x48], 0x69006d
mov dword [ebp - 0x44], 0x7d0064
mov dword [ebp - 0x40], 0x6d0026
mov dword [ebp - 0x3c], 0x640069
mov dword [ebp - 0x38], 0x3d0032
mov dword [ebp - 0x34], 0x6d007b
mov dword [ebp - 0x30], 0x640069
mov dword [ebp - 0x2c], 0x7d0032
mov dword [ebp - 0x28], 0x6d0026
mov dword [ebp - 0x24], 0x64006f
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x3d0072
mov dword [ebp - 0x18], 0x6d007b
mov dword [ebp - 0x14], 0x64006f
mov dword [ebp - 0x10], 0x650076
mov dword [ebp - 0xc], 0x7d0072
call fcn.10009e50
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 4
Function at 0x100292c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 0x1c], 0x6e0069
push esi
mov dword [ebp - 0x18], 0x200074
mov dword [ebp - 0x14], 0x65006e
mov dword [ebp - 0x10], 0x200074
mov dword [ebp - 0xc], 0x610066
mov dword [ebp - 8], 0x6c0069
mov word [ebp - 4], ax
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10029350
mov eax, dword [ecx]
push 2
push 0xc
call dword [eax]
test eax, eax
je 0x1002935a
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xc
jl 0x10029346
mov dword [eax - 0xc], 0xc
xor eax, eax
mov ecx, dword [esi]
push 0x18
mov word [ecx + 0x18], ax
lea eax, [ebp - 0x1c]
push eax
push 0x18
push dword [esi]
call fcn.1000a030
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10006b70
push 0x80004005
call fcn.10006b70
call fcn.10008530
int3

Function at 0x10029360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0xd
mov ecx, esi
mov dword [ebp - 0x24], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x65006e
mov dword [ebp - 0x1c], 0x5f0074
mov dword [ebp - 0x18], 0x6e0069
mov dword [ebp - 0x14], 0x740069
mov dword [ebp - 0x10], 0x66005f
mov dword [ebp - 0xc], 0x690061
mov dword [ebp - 8], 0x6c
call fcn.10009e50
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 4
Function at 0x10029580
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10139fd6
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10109d00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10029601
lea eax, [ebp - 0x218]
push eax
call ebx
sub esi, 1
jne 0x100295f3
push str.netul.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10029771
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10029655
movzx eax, ax
lea ecx, [ebp - 0x21c]
push eax
call fcn.10007f20
jmp 0x10029682
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10029660
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.100083a0
mov esi, dword [ebp - 0x21c]
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002969e
mov bl, 1
jmp 0x100296ac
push esi
call fcn.1002aa70
add esp, 4
test eax, eax
sete bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100296cb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x10029751
cmp dword [edi], 0
jne 0x10029738
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10029751
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x10029738
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x10029751
cmp dword [edi + 4], 0
je 0x10029751
cmp dword [edi + 0xc], 0
je 0x10029751
mov eax, 1
jmp 0x10029753
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10006b70
int3
Function at 0x1002d450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013a731
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x1002d5e4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002d5a5
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002d597
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002d5a5
add eax, 0x10
push 0x1018f248
push eax
mov dword [ebp - 0x20], eax
call fcn.100c59cb
mov esi, eax
add esp, 8
test esi, esi
je 0x1002d5a5
push dword [ebp - 0x20]
push 0
push esi
call fcn.10109d00
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002d55a
push esi
call fcn.100c5243
add esp, 4
jmp 0x1002d5a5
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002d560
sub ecx, edx
sar ecx, 1
je 0x1002d58e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002d576
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.100083a0
push esi
call fcn.100c5243
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002d5a5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1002d5c4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10006b70
int3
Function at 0x1002d5f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002d614
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x1002d676
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x1002d676
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1002d691
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10034040
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013ac2f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10187468]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x100341f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x100341fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10006e10
mov ecx, eax
test ecx, ecx
je 0x10034208
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10034118
xor ecx, ecx
jmp 0x10034130
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10034120
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.100083a0
push edi
mov ecx, ebx
call fcn.100066b0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1003414c
xor ecx, ecx
jmp 0x10034164
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10034154
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.100083a0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10034e70
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.100066b0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100341a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x100341de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100341de
cmp dword [esi + 0x10], 0
je 0x100341d5
push dword [edi]
call fcn.1011872c
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10006b70
push 0x80004005
call fcn.10006b70
push 0x80004005
call fcn.10006b70
int3
Function at 0x10034cf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013ad18
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x10034e51
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.__set_log_lev0
push edi
call ebx
test eax, eax
je 0x10034d48
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
jmp 0x10034e51
push str.__set_log_lev1
push edi
call ebx
test eax, eax
je 0x10034d62
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x10034e51
push str.__set_log_lev2
push edi
call ebx
test eax, eax
je 0x10034d7c
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
jmp 0x10034e51
push str.__set_log_lev3
push edi
call ebx
test eax, eax
je 0x10034d96
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
jmp 0x10034e51
push str.__reload_log_switch
push edi
call ebx
test eax, eax
je 0x10034e51
push 3
mov ecx, esi
call fcn.10034cb0
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.10014310
push 0x1014b040
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.100363a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10034dee
push 0
mov ecx, esi
call fcn.10034cb0
lea eax, [esi + 0x2c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x10034dff
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x44], 0
mov byte [ebp - 4], 1
je 0x10034e41
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x10034e41
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 4]
call eax
test al, al
je 0x10034e41
push str._______log_reload_switch
lea ecx, [ebp - 0x44]
call fcn.10010310
mov ecx, dword [esi + 0x44]
lea edx, [ebp - 0x44]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.100089e0
lea ecx, [ebp - 0x2c]
call fcn.100342c0
lea ecx, [ebp - 0x28]
call fcn.100089e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 4
Function at 0x10036ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x10036caf
pop ebp
jmp fcn.10037c10
xor eax, eax
pop ebp
ret 0xc
Function at 0x10037f10
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013b2c3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x10037fb5
cmp word [esi], di
je 0x10037fb5
test eax, eax
je 0x10037f71
cmp word [eax], di
je 0x10037f71
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x10037fb5
jmp 0x10037fb0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10109d00
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x10037fb5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1003802c
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x10038017
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x10037fe5
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x10038006
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x1003804c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x10038017
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1003802c
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c55ab
mov esp, ebp
pop ebp
ret 0x30
call fcn.1002e0c4
int3

Function at 0x10038af0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x10038b05
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10038b10
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10038b40
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10187468]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x10038d08
test eax, eax
je 0x10038d08
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x10038d08
push ecx
push ebx
push eax
call fcn.10109d00
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x10038d08
cmp edi, 0xffffffff
je 0x10038d01
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10046670
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10038d01
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x10038c97
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x10038d01
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x10038c97
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x10038c30
cmp edi, esi
jae 0x10038c97
nop
sub esi, edi
sbb ecx, eax
js 0x10038c45
jg 0x10038c40
cmp esi, 0x400000
jb 0x10038c45
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10038c97
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.100466c0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x10038c8b
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x10038c30
jg 0x10038c97
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x10038c30
lea eax, [ebp - 0x6c]
push eax
call fcn.10046560
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x1014b21c
push 3
push edi
call fcn.1001a190
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x10038cb0
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.1011b909
add esp, 8
mov esi, 1
test ebx, ebx
je 0x10038ced
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x10038cfb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c55ab
mov esp, ebp
pop ebp
ret