joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4063e7
xor eax, eax
test eax, eax
je 0x4063f9
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4063f9
xor ecx, ecx
jmp 0x4063fc
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4064e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232c4], 0
push esi
jne 0x40651f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064f9
mov dword [ecx*4 + 0x4232c0], eax
inc ecx
cmp ecx, 0x100
jl 0x4064f4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406550
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232c0]
xor eax, esi
inc ecx
dec edx
jne 0x406532
pop edi
not eax
pop esi
ret 0xc
Function at 0x10001300
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100351f3
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push ebx
push ebp
xor ebx, ebx
push esi
push edi
cmp byte [0x10046a24], bl
jne 0x100014c2
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 3
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
push ebx
lea edx, [esp + 0x24]
push edx
push ebx
push 0x10037638
push eax
call edi
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x1000138f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000150e
add eax, 0x10
push eax
push 8
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
mov esi, eax
push esi
lea eax, [esp + 0x24]
push eax
push ebx
push 0x1003763c
push ecx
call edi
cmp eax, ebx
je 0x100013d0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000150e
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x3c]
call fcn.10002410
push 0x100441c4
push esi
lea ecx, [esp + 0x44]
mov dword [esp + 0xc0], ebx
call fcn.10016350
lea ecx, [esp + 0x3c]
test eax, eax
jne 0x10001419
mov dword [esp + 0xb8], 0xffffffff
call fcn.10014360
xor eax, eax
jmp 0x1000150e
call fcn.10014140
cmp eax, 0x32
jge 0x1000142e
lea ecx, [esp + 0x3c]
call fcn.10014140
jmp 0x10001433
mov eax, 0x32
xor esi, esi
mov dword [0x10046a28], eax
cmp eax, ebx
jbe 0x100014a7
mov edi, 0x10046a50
lea ebp, [esi + 0xf]
push 0x10044200
lea ecx, [esp + 0x24]
push ecx
push esi
lea ecx, [esp + 0x48]
call fcn.10014100
mov ecx, eax
call fcn.100177c0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0xc4], 1
call fcn.10002020
cmp dword [esp + 0x38], 0x10
mov byte [esp + 0xb8], bl
jb 0x1000148f
mov edx, dword [esp + 0x24]
push edx
call fcn.10021970
add esp, 4
inc esi
add edi, 0x1c
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
cmp esi, dword [0x10046a28]
jb 0x10001446
lea ecx, [esp + 0x3c]
mov byte [0x10046a24], 1
mov dword [esp + 0xb8], 0xffffffff
call fcn.10014360
xor edi, edi
mov byte [esp + 0x13], bl
cmp dword [0x10046a28], ebx
jbe 0x10001509
mov ebp, dword [esp + 0xc0]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, 0x10046a54
cmp dword [esi + 0x14], 0x10
jb 0x100014ec
mov eax, dword [esi]
jmp 0x100014ee
mov eax, esi
push eax
push ebp
call ebx
test eax, eax
jne 0x10001504
inc edi
add esi, 0x1c
cmp edi, dword [0x10046a28]
jb 0x100014e2
jmp 0x10001509
mov byte [esp + 0x13], 1
movzx eax, byte [esp + 0x13]
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xac
ret
Function at 0x10001530
Capabilities:
Parse url

Disassembly:
sub esp, 0xb40
push 0x7ff
lea eax, [esp + 0x345]
push 0
push eax
mov byte [esp + 0x34c], 0
call fcn.10021df0
mov eax, dword [esp + 0xb50]
add esp, 0xc
lea ecx, [esp]
push ecx
lea edx, [esp + 0x344]
push edx
push 0x22
push eax
mov dword [esp + 0x10], 0x800
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
push 0xfe
lea ecx, [esp + 0x45]
push 0
push ecx
mov byte [esp + 0x4c], 0
call fcn.10021df0
push 0x3c
lea edx, [esp + 0x14]
push 0
push edx
call fcn.10021df0
lea eax, [esp + 0x58]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x358]
add esp, 0x18
mov dword [esp + 4], 0x3c
mov dword [esp + 0x18], 0xff
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100015c2
lea ecx, [esp + 4]
push ecx
sub eax, edx
push 0
push eax
lea edx, [esp + 0x34c]
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x100016a7
push edi
push 4
lea edi, [esp + 0x48]
push 0x10037640
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x10001606
lea edi, [esp + 0x48]
push ebp
push esi
push edi
call fcn.10001300
add esp, 4
test eax, eax
jne 0x10001656
xor esi, esi
cmp dword [0x10043004], esi
je 0x100016a4
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov eax, 0x10043004
mov edi, edi
mov ecx, dword [eax]
push ecx
push edi
call ebp
test eax, eax
je 0x10001656
inc esi
cmp dword [esi*4 + 0x10043004], 0
lea eax, [esi*4 + 0x10043004]
jne 0x10001630
pop esi
pop ebp
pop edi
add esp, 0xb40
ret
push 0x1ff
lea edx, [esp + 0x151]
push 0
push edx
mov byte [esp + 0x158], 0
call fcn.10021df0
lea eax, [esp + 0x158]
push 0x200
push eax
call fcn.10001130
mov edx, dword [esp + 0xb64]
add esp, 0x14
push 0x10000000
push 0xffffffffffffffff
lea ecx, [esp + 0x154]
push ecx
push edx
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
pop esi
pop ebp
pop edi
add esp, 0xb40
ret
Function at 0x100017b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035229
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9e4
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov eax, ecx
sub eax, 0
push edi
mov dword [ebp - 0x10], esp
je 0x10001a21
sub eax, 1
jne 0x10001a51
push 0xfe
push eax
mov byte [ebp - 0x110], al
lea eax, [ebp - 0x10f]
push eax
call fcn.10021df0
add esp, 0xc
push 0xff
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x110]
push str.rundll32
push eax
mov dword [0x10046a20], edx
call fcn.100219d0
lea ecx, [ebp - 0x110]
sub eax, ecx
mov edx, ecx
test eax, eax
push str.explorer.exe
push edx
setg bl
call fcn.100219d0
lea ecx, [ebp - 0x110]
sub eax, ecx
add esp, 0x10
test eax, eax
setg al
test bl, bl
jne 0x10001a63
test al, al
je 0x1000187f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
mov dword [0x10046a2c], eax
call esi
lea ecx, [ebp - 0x9f0]
mov dword [0x10046a30], eax
call fcn.1000e960
push str.HttpSendRequestW
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0
call fcn.1000e9f0
push 0x10037678
lea ecx, [ebp - 0x9f0]
call fcn.1000ea10
push 0x10001780
lea ecx, [ebp - 0x9f0]
call fcn.1000ea30
lea ecx, [ebp - 0x580]
call fcn.1000e960
push 0x10037684
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 1
call fcn.1000e9f0
push 0x10037698
lea ecx, [ebp - 0x580]
call fcn.1000ea10
push 0x10001750
lea ecx, [ebp - 0x580]
call fcn.1000ea30
lea ecx, [ebp - 0x348]
call fcn.1000e960
mov bl, 2
push 0x100376a4
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], bl
call fcn.1000e9f0
push 0x100376b8
lea ecx, [ebp - 0x348]
call fcn.1000ea10
push 0x100016b0
lea ecx, [ebp - 0x348]
call fcn.1000ea30
lea ecx, [ebp - 0x7b8]
call fcn.1000e960
push str.HttpOpenRequestW
lea ecx, [ebp - 0x7b8]
mov byte [ebp - 4], 3
call fcn.1000e9f0
push str.wininet.dll
lea ecx, [ebp - 0x7b8]
call fcn.1000ea10
push 0x10001700
lea ecx, [ebp - 0x7b8]
call fcn.1000ea30
lea edx, [ebp - 0x9f0]
push edx
mov ecx, 0x10046a34
call fcn.1000ee70
lea eax, [ebp - 0x580]
push eax
mov ecx, 0x10046a34
call fcn.1000ee70
lea ecx, [ebp - 0x348]
push ecx
mov ecx, 0x10046a34
call fcn.1000ee70
lea edx, [ebp - 0x7b8]
push edx
mov ecx, 0x10046a34
call fcn.1000ee70
mov ecx, 0x10046a34
call fcn.1000ed60
lea ecx, [ebp - 0x7b8]
mov byte [ebp - 4], bl
call fcn.1000e9e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x348]
call fcn.1000e9e0
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0
call fcn.1000e9e0
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0xffffffff
call fcn.1000e9e0
jmp 0x10001a56
mov eax, dword [0x10046a2c]
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
push eax
mov dword [ebp - 4], 4
call esi
mov ecx, dword [0x10046a30]
push ecx
call esi
mov ecx, 0x10046a34
call fcn.1000edd0
jmp 0x10001a63
cmp ecx, 1
jne 0x10001a63
cmp byte [0x10046ff4], 0
jne 0x1000186a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002500
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x10002532
cmp dword [esp + 4], 6
jne 0x10002532
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x10002590
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp]
push ecx
call fcn.100225f3
add esp, 0x108
ret

Function at 0x100025c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x208
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10021df0
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.10021df0
add esp, 0x18
lea edx, [esp]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x10037890
lea eax, [esp + 4]
push eax
push 0x1003789c
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.100226c5
lea edx, [esp + 0x118]
push edx
call fcn.100225f3
add esp, 0x220
ret

Function at 0x10002dd0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10002df0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x10002e04
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
inc eax
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x10002e30
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], ecx
test ebp, ebp
jne 0x10002e46
lea eax, [ebp + 0xd]
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10002e53
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x100033a0
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
sub esp, 0x208
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10021df0
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.10021df0
add esp, 0x18
lea edx, [esp]
push edx
push 1
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov eax, dword [esp + 0x20c]
push eax
lea ecx, [esp + 4]
push ecx
push str.__sInternet_ExplorerIEXPLORE.exe___s
lea edx, [esp + 0x110]
push 0x104
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 5
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0x1f
cmp ecx, eax
sbb eax, eax
neg eax
add esp, 0x208
ret 4

Function at 0x100034e0
Capabilities:
Initialize iwebbrowser2

Disassembly:
sub esp, 0x24
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp]
push eax
push 0x1003a838
push 4
push 0
push 0x1003a868
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1000359e
cmp dword [esp], 0
je 0x1000359e
push esi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov eax, 8
push ecx
mov word [esp + 0xc], dx
mov word [esp + 0x1c], ax
call fcn.10003900
add esp, 4
lea ecx, [esp + 8]
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov edx, dword [edx + 0xd0]
lea ecx, [esp + 0x28]
push ecx
push eax
call edx
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push 0xffffffffffffffff
push eax
call edx
test esi, esi
pop esi
jge 0x10003585
mov eax, dword [esp]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push eax
call edx
mov eax, dword [esp]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
add esp, 0x24
ret 4
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
add esp, 0x24
ret 4
Function at 0x100039b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx + 4]
push edi
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x18]
push ecx
xor ebx, ebx
or esi, 0x2001f
push esi
push ebx
push edx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov edi, eax
cmp edi, ebx
jne 0x10003a1d
xor eax, eax
cmp ecx, ebx
je 0x10003a05
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
and esi, 0x300
mov edi, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], esi
cmp eax, ebx
je 0x10003a33
cmp ecx, ebx
je 0x10003a28
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
push ebx
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
jne 0x10003a9a
jmp 0x10003a60
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.100039b0
mov edi, eax
cmp edi, ebx
jne 0x10003ada
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
push ecx
push ebx
push edx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
je 0x10003a60
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x10003aad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x1c]
push eax
mov dword [esp + 0x14], ebx
call fcn.10002ce0
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x10003acf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x10003ae9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10005f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035403
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x420], edi
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp ebx, edi
je 0x1000602b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
inc eax
cdq
push 2
push edx
push eax
call fcn.10022c50
mov edi, eax
add eax, 0x80000000
adc edx, esi
test edx, edx
ja 0x10006029
jb 0x10005fec
cmp eax, 0xffffffff
ja 0x10006029
cmp edi, 0x400
jg 0x1000600f
push edi
call fcn.10003860
add esp, 4
test al, al
je 0x1000600f
mov eax, edi
call fcn.10022c20
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000601b
push edi
lea ecx, [ebp - 0x14]
call fcn.10003ba0
mov esi, dword [ebp - 0x14]
push 3
push edi
push ebx
push eax
call fcn.10002ae0
test eax, eax
jne 0x10006063
xor edi, edi
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x10006044
lea ecx, [ebp - 0x420]
call fcn.100037f0
cmp esi, edi
je 0x10006059
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.10022a6c
add esp, 4
cmp esi, edi
jne 0x10006048
mov eax, 0x8007000e
jmp 0x100061a3
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x10006083
call fcn.10002c40
mov edi, eax
jmp 0x1000616f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100060a2
call fcn.10002c40
jmp 0x10006166
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100060bb
call fcn.10002c40
jmp 0x10006166
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp + 0x10], edi
cmp eax, edi
jae 0x100060fa
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x100060e8
lea ecx, [ebp - 0x420]
call fcn.100037f0
lea ecx, [ebp - 0x14]
call fcn.10003790
mov eax, 0x8007000e
jmp 0x100061a3
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.100042b0
mov dword [ebp - 4], 1
jmp 0x10006129
mov eax, dword [ebp - 0x420]
test eax, eax
jne 0x1000613a
mov edi, 0x8007000e
jmp 0x10006168
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push edi
push eax
call fcn.10002c10
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov byte [edx + edi], 0
mov ecx, dword [ebp - 0x420]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10005a50
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x41c]
cmp dword [ebp - 0x420], edx
je 0x10006188
lea ecx, [ebp - 0x420]
call fcn.100037f0
test esi, esi
je 0x100061a1
lea esp, [esp]
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.10022a6c
add esp, 4
test esi, esi
jne 0x10006190
mov eax, edi
lea esp, [ebp - 0x42c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100073a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100073e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x100073e0
lea ebx, [ebx]
cmp esi, eax
jae 0x100073e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100073d0
cmp esi, eax
jb 0x100073ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x100078c0
Capabilities:
Parse url

Disassembly:
sub esp, 0x548
push ebx
push esi
xor ebx, ebx
push 0xfe
lea eax, [esp + 0x155]
push ebx
push eax
mov byte [esp + 0x15c], bl
call fcn.10021df0
push 0xfe
lea ecx, [esp + 0x61]
push ebx
push ecx
mov byte [esp + 0x68], bl
call fcn.10021df0
push 0xfe
lea edx, [esp + 0x26d]
push ebx
push edx
mov byte [esp + 0x274], bl
call fcn.10021df0
push 0x1ff
lea eax, [esp + 0x379]
push ebx
push eax
mov byte [esp + 0x380], bl
call fcn.10021df0
push 0x3c
lea ecx, [esp + 0x48]
push ebx
push ecx
call fcn.10021df0
mov esi, dword [esp + 0x590]
mov eax, 0xff
lea edx, [esp + 0x18c]
add esp, 0x3c
mov dword [esp + 0x24], edx
lea edx, [esp + 0x250]
add esi, 0x24
mov dword [esp + 0x28], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x50]
mov eax, esi
mov dword [esp + 0x48], edx
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x40], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10007982
lea ecx, [esp + 0x14]
push ecx
push ebx
sub eax, edx
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
lea edx, [esp + 0x250]
push edx
lea eax, [esp + 0x54]
push eax
push 0x10038298
lea ecx, [esp + 0x35c]
push 0x200
push ecx
call fcn.100226c5
add esp, 0x14
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
push esi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x35c]
push ecx
push 0x50
lea edx, [esp + 0x164]
push edx
push ebx
push ebx
push ebx
push 0x100382a0
call fcn.1000dd20
add esp, 0x28
cmp dword [esp + 8], ebx
je 0x10007a50
mov eax, dword [esp + 0xc]
push edi
lea eax, [eax + eax*4]
add eax, eax
push eax
push 8
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0xc]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
call fcn.1001add0
push edi
call fcn.1000c590
add esp, 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push esi
call edi
mov eax, dword [esp + 0xc]
push eax
push ebx
push esi
call edi
pop edi
pop esi
pop ebx
add esp, 0x548
ret
Function at 0x10007a60
Capabilities:
Parse url

Disassembly:
sub esp, 0x548
push ebx
push esi
xor ebx, ebx
push 0xfe
lea eax, [esp + 0x155]
push ebx
push eax
mov byte [esp + 0x15c], bl
call fcn.10021df0
push 0xfe
lea ecx, [esp + 0x61]
push ebx
push ecx
mov byte [esp + 0x68], bl
call fcn.10021df0
push 0xfe
lea edx, [esp + 0x26d]
push ebx
push edx
mov byte [esp + 0x274], bl
call fcn.10021df0
push 0x1ff
lea eax, [esp + 0x379]
push ebx
push eax
mov byte [esp + 0x380], bl
call fcn.10021df0
push 0x3c
lea ecx, [esp + 0x48]
push ebx
push ecx
call fcn.10021df0
mov esi, dword [esp + 0x590]
mov eax, 0xff
lea edx, [esp + 0x18c]
add esp, 0x3c
mov dword [esp + 0x24], edx
lea edx, [esp + 0x250]
add esi, 0x424
mov dword [esp + 0x28], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x50]
mov eax, esi
mov dword [esp + 0x48], edx
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x40], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10007b25
lea ecx, [esp + 0x14]
push ecx
push ebx
sub eax, edx
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
lea edx, [esp + 0x250]
push edx
lea eax, [esp + 0x54]
push eax
push 0x100382a4
lea ecx, [esp + 0x35c]
push 0x200
push ecx
call fcn.100226c5
add esp, 0x14
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
push esi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x35c]
push ecx
push 0x50
lea edx, [esp + 0x164]
push edx
push ebx
push ebx
push ebx
push 0x100382ac
call fcn.1000dd20
add esp, 0x28
cmp dword [esp + 8], ebx
je 0x10007bf3
mov eax, dword [esp + 0xc]
push edi
lea eax, [eax + eax*4]
add eax, eax
push eax
push 8
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0xc]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
call fcn.1001add0
push edi
call fcn.1000c540
add esp, 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push esi
call edi
mov eax, dword [esp + 0xc]
push eax
push ebx
push esi
call edi
pop edi
pop esi
pop ebx
add esp, 0x548
ret