joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eeb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40eedc
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x40ee86
call fcn.0040da86
pop edi
scasd eax, dword es:[edi]
inc ecx
and byte fs:[ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040da86
xchg esi, eax
sti
sub ecx, ebx
lea eax, [ebp - 0x72c]
push eax
call fcn.0040da96
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040da4b
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0040da86
jbe 0x40ef66
clc
invalid
imul esp, dword [edi], 0xf8e8858d
invalid

Function at 0x40fe40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40fe57
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40fe86
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40fe82
cmp esi, eax
jae 0x40fe86
dec edi
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x40fe74
cmp esi, eax
jb 0x40fe8c
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4100c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4100f9
mov eax, dword [esp + 0xc]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 8

Function at 0x410860
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41088d
mov eax, dword [esp + 8]
sub eax, 3
neg eax
sbb eax, eax
and eax, 0xd
ret 8
Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xc
push 0
mov dword [edi], 0x4237d4
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0xc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x401082
sub eax, esi
sub eax, 0xa
mov dword [esi + 6], eax
mov byte [esi], 0xb9
mov byte [esi + 5], 0xe9
mov dword [esi + 1], edi
mov dword [edi + 8], esi
mov eax, edi
pop esi
leave
ret

Function at 0x401639
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
pop ecx
lea ecx, [esp + 0xc]
call 0x413dfe
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.00401613
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0
push 0x432b50
push 0x432f4c
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
test eax, eax
je 0x4016b8
push 0x4237ec
mov ecx, 0x427140
call fcn.00416d9e
pop ecx
call fcn.004010c5
mov esi, eax
call fcn.004019e4
test eax, eax
je 0x40173b
lea eax, [esp + 0xc]
push eax
mov eax, esi
call fcn.0040175c
push dword [eax]
call fcn.00414700
mov eax, dword [esp + 0x10]
pop ecx
add eax, 0xfffffff0
call fcn.00401613
mov eax, dword [esi]
push dword [eax + 0x5d4]
call fcn.00412df3
mov eax, dword [esi]
pop ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0x2c]
and ecx, 4
mov ebx, esi
mov dword [0x432f94], ecx
mov dword [0x4320ec], eax
call fcn.00403a74
call fcn.004097f8
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [0x432f4c]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 2
pop esi
jmp 0x40171f
Function at 0x404c17
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x21c
mov eax, 0x42085f
call fcn.0041fc5d
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x220], edi
test byte [0x433040], 1
mov ebx, ecx
mov dword [ebp - 0x228], eax
mov esi, section..data
jne 0x404c6b
mov eax, dword [section..data]
or dword [0x433040], 1
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
push 0x42276c
mov dword [0x43303c], eax
call fcn.0041f2c2
pop ecx
mov eax, dword [0x43303c]
cmp dword [eax - 0xc], edi
jne 0x404e2d
mov eax, dword [ebx]
cmp dword [eax + 0x5e4], edi
je 0x404e2d
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push ecx
mov dword [ebp - 4], edi
mov eax, dword [ebx]
mov ecx, esp
mov dword [ebp - 0x220], esp
push ecx
mov ecx, dword [eax + 0x5e4]
call fcn.00405495
lea ecx, [ebp - 0x21c]
call fcn.004142ee
lea eax, [ebp - 0x21c]
mov dword [esp], str..tlg
push eax
call fcn.00405532
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x21a], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x404d34
push 0x428324
lea eax, [ebp - 0x218]
push eax
call esi
push str.TencentLogs_
lea eax, [ebp - 0x218]
push eax
call esi
mov ebx, dword [ebp - 0x21c]
cmp dword [ebx - 4], 1
jle 0x404d63
push dword [ebx - 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.00401506
mov ebx, dword [ebp - 0x21c]
push ebx
lea eax, [ebp - 0x218]
push eax
call esi
or eax, 0xffffffff
lea esi, [ebp - 0x21c]
call fcn.0040583a
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404e21
lea eax, [ebp - 0x218]
push eax
mov esi, 0x43303c
push esi
call fcn.004013d5
lea eax, [ebp - 0x224]
push eax
call fcn.00412e80
pop ecx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x224]
cmp dword [eax - 0xc], edi
je 0x404e19
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.004056dc
pop ecx
pop ecx
mov edi, esi
mov byte [ebp - 4], 2
call fcn.004054f1
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.00401613
push dword [0x43303c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [0x43303c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.00401613
or dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
call fcn.00401613
mov eax, dword [0x43303c]
add eax, 0xfffffff0
call fcn.00405f8b
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0x228]
mov dword [eax], ecx
call fcn.0041fce0
ret 4
Function at 0x410dd4
Capabilities:
Authenticate hmac

Disassembly:
loopne 0x410e33
push 0x5e
ret 0x9eee
mov esp, 0x8ef1617f
cld
inc eax
in eax, 0x32
inc ecx
push edx
aam 0x83
pop edx
stosb byte es:[edi], al
sbb byte es:[edx], cl
cmc
add byte [eax - 0x77], 0xbe
sbb edi, dword [ecx + 0x33a362e0]
out dx, al
push ebx
sbb eax, ecx
mov ch, 0x42
sar byte [edi + 0x4b], 0x69
add ch, 0xf4
insd dword es:[edi], dx
jle 0x410ea2
sub al, byte [edx + ebp]
pop ds
xor cl, byte [edx + esi*4]
or al, 0xe9
and esi, edi
pop edi
inc esi
add ah, byte [edx - 0x75]
jns 0x410eaf
add al, 0x25
pop ebx
or al, 0xb2
pop esp
xor eax, esp
mov esi, 0x419f67c5
push cs
mov esp, 0x601fd66f
insd dword es:[edi], dx
lcall 0xd109, 0xea4fc5c0
rcr dword [esi - 0x605e68fc], 0x58
or esp, dword [edx + 0x6d]
xchg ebp, eax
sbb ah, byte [ebp + 0x796d6092]
or eax, 0xb4aad76
adc eax, 0x31c8d44c
lodsd eax, dword [esi]
dec edx
or edx, dword [0x31c8d44c]
push 0xb16dfcf0
sub cl, byte [ebx*2 - 0x1812c375]
test dword [ecx + 0x4a4c504b], ecx
mov eax, 0x747a09c5
cmp cl, ah
jno 0x410efb
pushal
in eax, 0x42
enter 0xffffffffffffb110, 0x17
sub esi, edx
fdiv st(0), st(0)
pop eax
mov edx, 0xa1730444
xor ch, byte [eax - 0x18a0c4d4]
sahf
push eax
push ebp
pushal
clc
rol byte [ebp + 0x1605e18a], cl
fcomi st(1)
idiv dword [esi]
out dx, eax
rol byte [esi + 0x2ae4aa18], 0xce
jno 0x410f0a
adc ebp, dword [eax + ebx*4 - 0x23]
mov ah, 0xf1
insb byte es:[edi], dx
cwde
fnsave dword [ecx + esi*8 - 0x59044c27]
xchg ecx, eax
push ebx
int1
fnstenv [ebx + 0x5391a6fb]
push 0x1ee62630
push edi
dec eax
wait
jge 0x410f44
loop 0x410ef6
std
adc bl, byte [ecx + edx*4]
and dword [ebx - 0x28081009], edx
mov eax, dword [esi + 0x51]
push ecx
out 0x36, eax
imul ebx, esi, 0xc85aa473
out 0x41, eax
out 0x67, eax
das
enter 0x41e7, 0xffffffffffffffe7
das
cdq
pop ebp
jp 0x410f23
dec ebx
cwde
pop esp
xchg esi, eax
mov ebx, 0xbff95b60
mov cl, 0xcc
call 0xbd7284de
aaa
adc ebp, dword [esi - 0x3ab899bb]
jl 0x410fbb
inc edi
lds edi, [ebx + esi*2 - 0x39]
and ebx, dword [edx - 0x73699278]
inc esi
invalid
invalid
or al, 0x5c
retf 0xcc2e

Function at 0x412850
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xf5
stc
btc dword [edx + edx - 0x11952f08], edi
fdivr dword [edi + 0x39]
sbb dl, byte [esi - 0x30d8c68e]
bound eax, qword [eax - 0x5bec8c51]
xor ah, bh
lds esi, [eax]
mov ah, 0xcf
sub byte [ebp - 0x51074a5b], dl
arpl word [eax], si
lodsb al, byte [esi]
aad 0xf9
invalid
or esi, dword [ecx + 0x45]
mov byte [0xd62606c6], ah
mov dword [0x6505c4a6], eax
inc edx
jmp 0x4127bd
add eax, esi
out dx, eax
out dx, eax
xor esp, ecx
pop esi
lds edi, [ebp + 0x7d]
jl 0x412854
jg 0x412802
lea edx, [ebp + ebp*8 + 0x70]
mov al, 0xe4
and esp, dword [edx + esi*8 + 0x53ee723c]
pushfd
ror dword gs:[edi], cl
push es
and al, 0x22
ljmp 0xe324
Function at 0x40b9b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x40b9e8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x40b9f2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40b9e1
mov dword [esi], ebx
call fcn.004ef4b0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x40ba2b
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e64c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x40b9d2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ba67
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x40ba61
call dword [0x63e64c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x40ba05
push 1
push 0
jmp 0x40ba57
xor eax, eax
push eax
jmp 0x40ba56
Function at 0x40f070
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x40f0ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x40f0cc
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40f0a7
mov dword [esi], ebx
call fcn.004ef4b0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x40f141
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x40f105
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e64c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x40f098
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f144
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x40f13b
call dword [0x63e64c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x40f0df
push 1
push 0
jmp 0x40f131
int3
xor eax, eax
push eax
jmp 0x40f130
Function at 0x41bc80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi], ecx
mov ebx, dword [eax]
mov dword [eax], ecx
lea edi, [ebx + 1]
cmp edi, 2
jb 0x41bca3
call fcn.004ef4b0
cmp dword [esi], ebx
je 0x41bccd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x41bcd9
cmp edi, 2
jb 0x41bcc4
mov dword [esi], ebx
call fcn.004ef4b0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x41bd12
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e64c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x41bcb8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41bd4e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x41bd48
call dword [0x63e64c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x41bcec
push 1
push 0
jmp 0x41bd3e
xor eax, eax
push eax
jmp 0x41bd3d
Function at 0x41df60
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x28], eax
test byte [ebp + 0xc], 0x40
je 0x41e05c
xor esi, esi
dec esi
mov edi, 0xffffbfff
mov dword [esp + 4], esi
mov dword [esp], esi
mov eax, dword [0x6496dc]
mov ecx, dword [0x64783c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x41e071
mov ecx, dword [0x6496d8]
test ecx, ecx
je 0x41e0bd
call dword [0x63e64c]
push 8
lea eax, [esp + 4]
push eax
call ecx
test eax, eax
je 0x41e0d4
mov ebx, dword [esp]
cmp edi, ebx
mov eax, esi
sbb eax, dword [esp + 4]
jb 0x41df89
shl ebx, 0xa
and ebx, 0xff0000
add ebx, 0x80000
xor esi, esi
jmp 0x41e00e
push 1
push 0x2000
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add esi, edi
cmp esi, ebx
jae 0x41e05c
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0xc], xmm0
movdqa xmmword [esp], xmm0
push 0x1c
lea eax, [esp + 4]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x41e05c
mov eax, ebx
sub eax, esi
mov edi, dword [esp + 0xc]
mov ecx, 0xffff
add edi, ecx
and edi, 0xffff0000
cmp eax, edi
cmovb edi, eax
test esi, esi
je 0x41e008
cmp dword [esp + 0x10], 0x10000
jne 0x41e008
jmp 0x41dff6
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.00568175
mov al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6496dc
call fcn.00564ee8
add esp, 4
cmp dword [0x6496dc], 0xffffffff
jne 0x41dfb1
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x41e0d7
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6496d8], eax
push 0x6496dc
call fcn.00564f37
add esp, 4
jmp 0x41dfb1
push 8
lea eax, [esp + 4]
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x41dfd6
int3
int3
int3
Function at 0x420010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x6460b0]
cmp eax, 0xffffffff
je 0x4200d1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x4200d1
mov eax, dword [0x64a708]
mov ecx, dword [0x64783c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4200db
mov edi, dword [0x64a704]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x42011f
mov ecx, dword [0x6496fc]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x649700], 0
jne 0x42012b
lea ecx, [ebx + 0x649700]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x64a700]
inc edx
mov dword [0x64a700], edx
mov dword [ecx + 0xc], edx
mov dword [0x6496fc], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x42011c
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004126f0
jmp 0x420035
push 0x64a708
call fcn.00564ee8
add esp, 4
cmp dword [0x64a708], 0xffffffff
jne 0x420056
push 4
call fcn.00564ea5
add esp, 4
mov dword [eax], 0
mov dword [0x64a704], eax
push 0x64a708
call fcn.00564f37
add esp, 4
jmp 0x420056
int3
mov ecx, edi
call fcn.00505f10
jmp 0x42006b
inc edx
cmp edx, 0x100
jne 0x420074
jmp 0x4200bb

Function at 0x420140
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x420163
call fcn.004ef4b0
mov dword [esi], 0
test ebx, ebx
je 0x420193
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4201b8
cmp edi, 2
jb 0x42018a
mov dword [esi], ebx
call fcn.004ef4b0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x42022d
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x4201f1
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e64c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x42017e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420237
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x420227
call dword [0x63e64c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x4201cb
push 1
push 0
jmp 0x42021d
call fcn.00553f00
jmp 0x4201ac
xor eax, eax
push eax
jmp 0x42021c
Function at 0x4254b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4254d3
call fcn.004ef4b0
cmp dword [esi], ebx
je 0x4254fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x425522
cmp edi, 2
jb 0x4254f4
mov dword [esi], ebx
call fcn.004ef4b0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x425597
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x42555b
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e64c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4254e8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4255a1
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x425591
call dword [0x63e64c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x425535
push 1
push 0
jmp 0x425587
call fcn.00553f00
jmp 0x425516
xor eax, eax
push eax
jmp 0x425586

Function at 0x4255b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.005666c2
add esp, 4
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8