joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493c70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4b6798]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov edx, dword [esi + 0x14]
mov ecx, dword [edx]
cmp ecx, edx
je 0x459b9d
cmp edi, dword [ecx + 0x10]
je 0x459b8f
cmp byte [ecx + 0x15], 0
jne 0x459b89
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], 0
jne 0x459b6e
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x459b89
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x459b62
jmp 0x459b89
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], 0
jne 0x459b87
cmp ecx, dword [eax + 8]
jne 0x459b87
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x459b77
mov ecx, eax
cmp ecx, edx
jne 0x459b44
jmp 0x459b9d
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0045de50
cmp dword [esi + 0x18], 0
jne 0x459c20
cmp dword [0x4e1798], 0
je 0x459c20
mov edx, dword [ebp - 0x28]
and edx, 0xffffff05
or edx, 5
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x30]
mov edx, 0x4a3e24
mov dword [ebp - 4], 0
call fcn.00457e90
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0044ef10
movsx eax, byte [ebp - 0x18]
cmp eax, 7
ja case.0x459bf4.0
jmp dword [eax*4 + 0x459c84]
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x1c]
jmp 0x459c4e
fld qword [ebp - 0x20]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp case.0x459bf4.0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.0044ef10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x20]
jmp 0x459c4c
mov eax, dword [ebp - 0x20]
test eax, eax
je case.0x459bf4.0
cmp byte [eax], 0
jmp 0x459c4e
mov edx, dword [ebp - 0x20]
cmp dword [edx + 8], 0
setne al
test al, al
jne 0x459c11
mov eax, dword [0x4e1798]
lea esi, [eax + 0x2c]
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x459c11
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x28]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00435600
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x459cc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491e7b
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4b6798]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4e1794]
xor ebx, ebx
push ebx
push str.32770
push ebx
push ebx
mov dword [ebp - 0x45c], eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
cmp edi, ebx
je 0x459e86
push edi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, ebx
je 0x459e6e
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x459e6e
xor edx, edx
lea eax, [ebp - 0x218]
mov word [ebp - 0x458], dx
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x459d60
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x458]
call fcn.00409bc0
push 0x10
push str.Chrome_WidgetWin
mov eax, esi
push eax
xor eax, eax
mov dword [ebp - 4], ebx
call fcn.00403340
test eax, eax
jne 0x459e4f
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x459e4f
xor edx, edx
lea eax, [ebp - 0x420]
mov word [ebp - 0x43c], dx
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x42c], ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x459de0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x43c]
call fcn.00409bc0
mov esi, 7
push esi
push str.Save_As
lea eax, [ebp - 0x43c]
push eax
xor eax, eax
call fcn.00403340
test eax, eax
je 0x459eb2
cmp dword [ebp - 0x428], 8
jb 0x459e3a
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.004736d0
add esp, 4
xor edx, edx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x42c], ebx
mov word [ebp - 0x43c], dx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x444], 8
jb 0x459e6e
mov eax, dword [ebp - 0x458]
push eax
call fcn.004736d0
add esp, 4
push ebx
push str.32770
push edi
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
cmp edi, ebx
jne 0x459d13
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x45c]
sub eax, dword [ecx + 0x24]
cmp eax, 0x1f40
jbe 0x459f07
mov edx, dword [ebp + 8]
push edx
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x45c]
mov dword [eax + 0x24], ebx
jmp 0x459f19
push ebx
push ebx
push 0x10
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, 8
cmp dword [ebp - 0x428], edi
jb 0x459ed9
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.004736d0
add esp, 4
xor edx, edx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x42c], ebx
mov word [ebp - 0x43c], dx
cmp dword [ebp - 0x444], edi
jb 0x459e9c
mov eax, dword [ebp - 0x458]
push eax
call fcn.004736d0
add esp, 4
jmp 0x459e9c
push 0x459cb0
push 0x96
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004736db
mov esp, ebp
pop ebp
ret 4
Function at 0x45ac30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491e48
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4b6798]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x2c], ax
xor edi, edi
push 0x1b
mov eax, str.SOFTWAREClassesInterface_
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
call fcn.00409bc0
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
push 0x26
push str.70986DDF_4AA8_4DFB_9A45_6F0D88897CAC
mov eax, esi
mov byte [ebp - 4], 2
call fcn.004046f0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x45acae
mov eax, esi
lea ecx, [ebp - 0x30]
push ecx
push 0xf003f
lea edx, [ebp - 0x3c]
push edx
mov ecx, SysReAllocString
call fcn.0040f4c0
mov ebx, dword [ebp - 0x3c]
test eax, eax
jne 0x45ad15
cmp dword [ebp - 0x30], 1
jne 0x45ad15
push edi
push 0x2001f
lea eax, [ebp - 0x48]
push eax
mov eax, str.ProxyStubClsid32
mov ecx, ebx
call fcn.0040f4c0
mov esi, dword [ebp - 0x48]
test eax, eax
jne 0x45ad0a
mov ecx, dword [ebp + 8]
push 4
lea edx, [ebp - 0x30]
push edx
push 4
push edi
push 0x49be3c
push esi
mov dword [ebp - 0x30], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, edi
je 0x45ad15
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x45ad20
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 8
jb 0x45ad32
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004736d0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004736db
mov esp, ebp
pop ebp
ret 4
Function at 0x45bf00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x494f50
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4b6798]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov esi, dword [0x4e1794]
and eax, 0xffffff05
xor ebx, ebx
or eax, 5
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov byte [esp + 0x1c], bl
lea ecx, [esp + 0xc]
push ecx
push esi
lea eax, [esp + 0x24]
mov edx, str.local_network
mov dword [esp + 0x40], ebx
call fcn.00457e90
lea eax, [esp + 0x1c]
mov byte [esp + 0x38], 2
call fcn.0044ef10
movsx eax, byte [esp + 0x14]
cmp eax, 7
ja case.0x45bf7b.0
jmp dword [eax*4 + 0x45c020]
mov edx, dword [esp + 0xc]
or edx, dword [esp + 0x10]
jne 0x45bff7
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [esi + 8]
call fcn.00402640
shr eax, 0xc
and al, 1
mov bl, al
lea eax, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0044ef10
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
fld qword [esp + 0xc]
fldz
fucompp
fnstsw ax
test ah, 0x44
jp 0x45bff7
jmp case.0x45bf7b.0
mov al, byte [esp + 0xc]
jmp 0x45bff3
mov eax, dword [esp + 0xc]
cmp eax, ebx
je case.0x45bf7b.0
cmp byte [eax], bl
jmp 0x45bf8a
mov eax, dword [esp + 0xc]
cmp dword [eax + 8], ebx
setne al
cmp al, bl
je case.0x45bf7b.0
lea eax, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0044ef10
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x463350
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x4633a0
mov ecx, dword [ebp + 0xc]
push str.__MAPVK_VK_TO_VSC__failed_
push ecx
push str.MapVirtualKey_
push str._r_nOBS:
push 0x4e14a8
call fcn.004608a0
push eax
call fcn.004608a0
mov edi, eax
call fcn.00460920
push eax
call fcn.004608a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x24]
mov cl, byte [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
xor edx, edx
test cl, cl
sete dl
mov ebx, eax
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 0x18]
shl ebx, 0x10
mov dword [ebp - 0xc], esi
add edx, 0x100
mov dword [ebp - 0x18], edx
test cl, cl
je 0x4633d8
mov eax, ebx
or eax, 1
mov dword [ebp - 0x10], eax
jmp 0x4633e3
mov ecx, ebx
or ecx, 0xc0000001
mov dword [ebp - 0x10], ecx
cmp edx, 0x102
sete dl
movzx eax, dl
push eax
sub esp, 0x1c
mov ecx, 7
lea esi, [ebp - 0x1c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.004631f0
add esp, 0x20
test al, al
jne 0x463449
cmp byte [ebp + 8], al
je 0x463449
mov ecx, dword [ebp + 0x24]
movzx edx, word [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push 1
mov dword [ebp - 0x1c], ecx
sub esp, 0x1c
or ebx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], eax
mov ecx, 7
lea esi, [ebp - 0x1c]
mov edi, esp
mov dword [ebp - 0x18], 0x102
mov dword [ebp - 0x10], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004631f0
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4671a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
mov edx, dword [esi]
mov edx, dword [edx + 4]
push ebx
push eax
mov ecx, esi
call edx
mov ebx, eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ecx + eax + 0x7c]
mov dword [ebp - 0x24], eax
test ebx, ebx
je 0x4672e7
test eax, eax
je 0x4672e7
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 0x28], edx
mov edx, dword [esi]
mov edx, dword [edx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x1c]
push edi
mov dword [ebp - 0x18], ecx
push eax
mov ecx, esi
call edx
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov edx, dword [eax + 4]
push ecx
mov ecx, esi
call edx
mov ecx, dword [ebx + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov edx, dword [eax + 4]
push ecx
mov ecx, esi
call edx
xor edi, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], edi
cmp dword [ebp - 0x10], edi
jbe 0x4672d7
jmp 0x467230
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + edi*4]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push edx
mov ecx, esi
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4672ca
mov ecx, dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 0xc], 0
test ecx, ecx
je 0x46728d
jmp 0x467260
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx + edi*2]
cmp edx, dword [ebp - 8]
je 0x467273
inc edi
cmp edi, ecx
jb 0x467260
jmp 0x46728d
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + edi*4]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push edx
mov ecx, esi
call eax
mov dword [ebp - 0xc], eax
test eax, eax
mov eax, dword [ebp - 4]
jne 0x46728f
xor edi, edi
xor ecx, ecx
cmp eax, ebx
jb 0x4672aa
mov edx, dword [ebp - 0x24]
add edx, ebx
cmp eax, edx
ja 0x4672aa
mov dword [ebp - 4], 0
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x28]
push 0
push ecx
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push edx
push esi
call fcn.00462880
add esp, 0x1c
test al, al
je 0x4672df
mov edi, dword [ebp - 8]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0x10]
jb 0x467230
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4681a0
Capabilities:
Create thread

Disassembly:
push 0x4e18e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4b8c44], 0
je 0x4681f7
mov eax, dword [0x4e18d8]
cmp eax, 3
jae 0x4681f7
push esi
mov ecx, 3
xor esi, esi
sub ecx, eax
je 0x4681f6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0x4e18d4
push 0x4680e0
push 0
push 0
call edi
mov edx, 3
sub edx, dword [0x4e18d8]
inc esi
cmp esi, edx
jb 0x4681d1
pop edi
pop esi
push 0x4e18e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret
Function at 0x469fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b6798]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1c
push 0
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test ebx, ebx
js 0x46a085
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
jmp 0x46a020
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46a020
sub eax, edx
push esi
sar eax, 1
push eax
lea esi, [edi + 0x20]
lea eax, [ebp - 0x20c]
call fcn.00409bc0
push esi
call fcn.0046ee30
add esp, 4
push 7
push 0x4a57bc
mov eax, esi
call fcn.004046f0
push 0
add edi, 4
push esi
or eax, 0xffffffff
mov ecx, edi
call fcn.004097e0
push 1
push 0x49c478
mov eax, edi
call fcn.004046f0
push 0x16
push str.ietab_nm_manifest.json
mov eax, edi
call fcn.004046f0
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004736db
mov esp, ebp
pop ebp
ret

Function at 0x46a0a0
Capabilities:
Create directory

Disassembly:
push esi
lea esi, [eax + 0x3c]
add eax, 0x20
push 0
push eax
or eax, 0xffffffff
mov ecx, esi
call fcn.004097e0
push 1
push 0x49c478
mov eax, esi
call fcn.004046f0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46a0c7
sub eax, edx
sar eax, 1
push eax
push edi
mov eax, esi
call fcn.004046f0
cmp dword [esi + 0x14], 8
jb 0x46a0e9
mov eax, dword [esi]
jmp 0x46a0eb
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 1
push 0x49c478
mov eax, esi
call fcn.004046f0
push 0xf
push 0x49d06c
mov eax, esi
call fcn.004046f0
pop esi
ret
Function at 0x46dc80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4b6798]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], edx
test esi, esi
je 0x46dcea
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [eax + eax + 2]
mov eax, ebx
call fcn.00486070
mov edi, esp
test edi, edi
je 0x46dcea
push ebx
push edi
push 0xffffffffffffffff
xor eax, eax
push esi
push eax
push 0xfde9
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, edi
jmp 0x46dcec
xor ebx, ebx
mov edx, dword [ebp - 0x424]
xor ecx, ecx
push ecx
push edx
push ecx
push ecx
mov word [ebp - 6], cx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
test edi, edi
je 0x46de12
push 0x1fe
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x46ddb2
xor ecx, ecx
lea eax, [ebp - 0x404]
mov dword [ebp - 0x40c], 7
mov dword [ebp - 0x410], 0
mov word [ebp - 0x420], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46dd50
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x404]
lea esi, [ebp - 0x420]
call fcn.00409bc0
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46dd76
sub eax, edx
sar eax, 1
push eax
push ebx
lea edx, [ebp - 0x420]
push edx
xor eax, eax
call fcn.00403340
cmp eax, 0xffffffff
jne 0x46ddf2
cmp dword [ebp - 0x40c], 8
jb 0x46ddb2
mov eax, dword [ebp - 0x420]
push eax
call fcn.004736d0
add esp, 4
mov esi, dword [ebp - 0x42c]
cmp byte [esi], 0
jne 0x46ddd4
push 0
push str.Chrome_RenderWidgetHostHWND
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x46ddd4
mov byte [esi], 1
mov ecx, dword [ebp - 0x424]
push 0
push ecx
push edi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
test edi, edi
jne 0x46dd0c
jmp 0x46de12
cmp dword [ebp - 0x40c], 8
mov edx, dword [ebp - 0x428]
mov dword [edx], edi
jb 0x46de12
mov eax, dword [ebp - 0x420]
push eax
call fcn.004736d0
add esp, 4
lea esp, [ebp - 0x438]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004736db
mov esp, ebp
pop ebp
ret
Function at 0x46e0b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491918
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4b6798]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x10]
push eax
push 0x20119
push edi
push str.SOFTWAREIE_Tab_
mov dword [ebp - 4], edi
push ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x46e23b
mov esi, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edi
push 0x4a5cd0
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 4
push esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0x100
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x46e156
cmp dword [ebp - 0x18], ebx
jne 0x46e156
cmp dword [ebp - 0x10], eax
je 0x46e156
push eax
push eax
push str.Attach_Debugger
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push str.DebugMessages
push esi
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
jne 0x46e184
cmp dword [ebp - 0x14], ebx
jne 0x46e184
cmp dword [ebp - 0x10], eax
je 0x46e184
mov byte [0x4e179c], 1
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push str.DebugTrace
push esi
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
je 0x46e1a5
mov ebx, eax
jmp 0x46e1bd
cmp dword [ebp - 0x14], ebx
je 0x46e1b1
mov ebx, 0xd
jmp 0x46e1bd
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
je 0x46e1bd
call fcn.0046fe50
cmp byte [0x4e179c], 0
jne 0x46e1cf
test ebx, ebx
jne 0x46e1d6
cmp dword [ebp - 0x10], ebx
je 0x46e1d6
mov byte [0x4e1657], 1
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push str.NavCancelBehavior
mov ebx, 4
push esi
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
jne 0x46e206
cmp dword [ebp - 0x14], ebx
jne 0x46e206
mov edx, dword [ebp - 0x10]
mov dword [0x4b8c40], edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push str.EnablePopupThreads
push esi
mov dword [ebp - 0x18], ebx
call edi
test eax, eax
jne 0x46e230
cmp dword [ebp - 0x14], ebx
jne 0x46e230
mov eax, dword [ebp - 0x10]
mov dword [0x4b8c44], eax
test esi, esi
je 0x46e23b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ea80
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x46ea97
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
test edi, edi
je 0x46eb14
push edi
mov eax, esi
call fcn.0046e9b0
test al, al
je 0x46eb14
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0047cc30
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x38], ecx
mov ecx, dword [esi + 0x10]
add esp, 0xc
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x3c]
push ecx
push 0x10000000
mov dword [ebp - 0x2c], edx
mov edx, dword [esi + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
push 0
push ebx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x46eb1e
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov dword [esi + 0x24], edx
mov edx, dword [ebp - 0x14]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], edx
mov edx, dword [ebp - 0x30]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x48], edx
test eax, eax
je 0x46ec11
mov edx, dword [esi + 0x14]
mov eax, edx
lea edi, [eax + 2]
jmp 0x46eb60
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46eb60
sub eax, edi
sar eax, 1
lea edi, [edx + eax*2]
movzx eax, word [edi]
cmp eax, 0x2f
jne 0x46eb86
movzx eax, word [edi - 2]
sub edi, 2
cmp eax, 0x2f
je 0x46ebd3
cmp ax, 0x2e
jne 0x46ebc7
cmp dword [esi + 0x40], 0
jne 0x46ebc7
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46eb97
sub eax, edx
sar eax, 1
mov dword [esi + 0x40], eax
je 0x46ebc7
mov ecx, dword [esi + 0x20]
add eax, eax
push eax
push edi
push ecx
call fcn.00479800
mov edx, dword [esi + 0x40]
mov eax, dword [esi + 0x20]
add esp, 0xc
xor ecx, ecx
mov word [eax + edx*2], cx
movzx eax, word [edi - 2]
sub edi, 2
cmp eax, 0x2f
jne 0x46eb86
add edi, 2
mov eax, edi
lea edx, [eax + 2]
jmp 0x46ebe0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46ebe0
sub eax, edx
sar eax, 1
mov dword [esi + 0x3c], eax
je 0x46ec11
lea edx, [eax + eax]
mov eax, dword [esi + 0x1c]
push edx
push edi
push eax
call fcn.00479800
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x1c]
add esp, 0xc
xor eax, eax
mov word [edx + ecx*2], ax
movzx ecx, word [ebp - 0x24]
pop edi
mov dword [esi + 0x44], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46edb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
movzx eax, word [ebp + 8]
push str.FILE
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebx + 0x10]
mov edi, eax
lea eax, [edi + 1]
cmp eax, ecx
ja 0x46ee01
push 0xffffffffffffffff
push eax
mov ecx, ebx
call fcn.00408930
jmp 0x46ee0d
push 0
sub eax, ecx
push eax
mov esi, ebx
call fcn.0041b420
cmp dword [ebx + 0x14], 0x10
jb 0x46ee15
mov ebx, dword [ebx]
mov ecx, dword [ebp + 0xc]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call fcn.00479800
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret