joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e29c4
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov dword [ebp - 4], edx
lea eax, [ebp - 0x100]
xor ecx, ecx
mov edx, 0x80
call fcn.00404dd8
mov dword [ebp - 8], 0x38
mov eax, str.80_
lea edx, [ebp - 0x48]
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
mov esi, 0x80
shr esi, cl
movzx ecx, bl
shr ecx, 3
add ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x5e2a1b
mov byte [edx], 1
jmp 0x5e2a1e
mov byte [edx], 0
inc edx
inc eax
dec dword [ebp - 8]
jne 0x5e29f3
xor eax, eax
mov dword [ebp - 8], eax
mov esi, 0x65aa06
cmp byte [ebp + 8], 0
je 0x5e2a44
mov eax, 0xf
sub eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
jmp 0x5e2a4c
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
lea edx, [ebp - 0x80]
movzx ecx, byte [esi]
add ecx, eax
cmp ecx, 0x1c
jae 0x5e2a6b
movzx ecx, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x5e2a72
movzx ecx, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x1c
jne 0x5e2a58
mov eax, 0x1c
lea edx, [ebp - 0x64]
movzx ecx, byte [esi]
add ecx, eax
cmp ecx, 0x38
jae 0x5e2a94
movzx ecx, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x5e2a9b
movzx ecx, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x38
jne 0x5e2a81
mov ecx, 0x1000000
mov eax, 0x18
mov edx, 0x6581b8
shr ecx, 1
movzx ebx, byte [edx]
cmp byte [ebp + ebx - 0x80], 0
je 0x5e2ac7
mov ebx, dword [ebp - 0xc]
or dword [ebp + ebx*4 - 0x100], ecx
movzx ebx, byte [edx + 0x18]
cmp byte [ebp + ebx - 0x80], 0
je 0x5e2adc
mov ebx, dword [ebp - 0x10]
or dword [ebp + ebx*4 - 0x100], ecx
inc edx
dec eax
jne 0x5e2ab1
inc dword [ebp - 8]
inc esi
cmp dword [ebp - 8], 0x10
jne 0x5e2a2f
mov eax, dword [ebp + 0xc]
add eax, eax
add eax, eax
add dword [ebp + 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0xfc0000
shl ecx, 6
and eax, 0xfc0
shl eax, 0xa
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0xfc0000
shr eax, 0xa
or ecx, eax
and edx, 0xfc0
shr edx, 6
or ecx, edx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
add dword [ebp + 0x10], 4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0x3f000
shl ecx, 0xc
and eax, 0x3f
shl eax, 0x10
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0x3f000
shr eax, 4
or ecx, eax
and edx, 0x3f
or ecx, edx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
add dword [ebp + 0x10], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jne 0x5e2afd
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5ec314
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [0x6617f0]
mov edx, dword [eax]
call dword [edx]
xor edx, edx
push ebp
push 0x5ec38d
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [0x661660], 0
jne 0x5ec375
push 0x661660
push 0x202
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x5ec375
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0
push ebx
mov ecx, 0x5ec3a8
mov dl, 1
mov eax, dword [0x5ebbbc]
call fcn.005ec438
call fcn.00406708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec394
mov eax, dword [0x6617f0]
mov edx, dword [eax]
call dword [edx + 4]
ret

Function at 0x5ec6cc
Capabilities:
Set socket configuration

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
cmp edx, dword [ebx + 0x20]
je 0x5ec723
mov dword [ebx + 0x20], edx
cmp dword [ebx + 0x28], 0xffffffff
je 0x5ec723
test edx, edx
jle 0x5ec723
push 0
push 0x3e8
mov eax, dword [ebx + 0x20]
cdq
call fcn.00408ea8
mov dword [esp], eax
mov dword [esp + 4], edx
push 8
lea eax, [esp + 4]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
sete al
neg al
sbb eax, eax
call fcn.00428830
pop ecx
pop edx
pop ebx
ret

Function at 0x5ec728
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
cmp edx, dword [ebx + 0x24]
je 0x5ec77d
mov esi, edx
mov dword [ebx + 0x24], esi
cmp dword [ebx + 0x28], 0xffffffff
je 0x5ec77d
push 0
push 0x3e8
mov eax, esi
cdq
call fcn.00408ea8
mov dword [esp], eax
mov dword [esp + 4], edx
push 8
lea eax, [esp + 4]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
sete al
neg al
sbb eax, eax
call fcn.00428830
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5ec7f4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ec880
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
mov eax, edi
call fcn.0040797c
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x5ec831
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
jmp 0x5ec86a
lea eax, [ebp - 4]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x5ec89c
call fcn.00421c24
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.004073f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec887
lea eax, [ebp - 4]
call fcn.00407010
ret
Function at 0x5f02e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x5edfc4]
call fcn.005eeca4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f03ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x1c]
push eax
call sub.kernel32.dll_InterlockedIncrement
mov dword [ebx], eax
call fcn.005eff70
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebx + 0x28]
call fcn.00407464
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebx + 0xc]
call fcn.00407464
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x14]
call fcn.00407464
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
add eax, 0x44
mov edx, dword [ebx + 0x1c]
call fcn.00407464
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 4]
add eax, 0x4c
mov edx, dword [ebx + 0x24]
call fcn.00407464
mov eax, dword [ebp - 4]
add eax, 0x50
mov edx, dword [ebx + 0x2c]
call fcn.00407464
mov eax, dword [ebp - 4]
add eax, 0x54
mov edx, dword [ebx + 0x30]
mov ecx, dword [0x5edbb4]
call fcn.00409634
mov eax, dword [ebp - 4]
add eax, 0x58
mov edx, dword [ebx + 0x40]
mov ecx, dword [0x5ed2b0]
call fcn.00409634
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.005f04e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5f0405
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x6124d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004070f4
xor eax, eax
push ebp
push 0x612557
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0044d084
mov ebx, eax
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.004073f0
mov word [ebx + 0x10], si
Function at 0x62bfb4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x62bfbc
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x62c1c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
movzx edx, word [0x66180a]
call fcn.00407f90
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
call fcn.004084d8
test eax, eax
je 0x62c199
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
mov dl, 1
call dword [eax + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xc]
movzx edx, word [0x66180a]
call fcn.00407f90
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0x1a], 0
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0x40], 1
xor eax, eax
push ebp
push 0x62c187
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00407010
lea eax, [ebp - 4]
call fcn.00407010
mov bl, 1
xor esi, esi
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x30]
test bl, bl
je 0x62c077
lea eax, [ebp - 4]
call fcn.00407010
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
test esi, esi
je 0x62c171
mov bl, 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004082f4
jne 0x62c161
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test al, al
je 0x62c161
lea eax, [ebp - 4]
call fcn.00407010
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
cmp esi, 0xffffff99
je 0x62c0d3
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call dword [eax + 0x3c]
test al, al
je 0x62c0ce
cmp esi, 0xffffff97
je 0x62c0d3
cmp esi, 0x64
jl 0x62c146
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407438
cmp esi, 0xffffff97
jne 0x62c110
lea eax, [ebp - 4]
call fcn.00407010
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
cmp esi, 0xffffff99
je 0x62c101
cmp esi, 0x64
jl 0x62c10e
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408164
jmp 0x62c110
xor ebx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0062c5f8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x62c05f
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0x28]
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00408164
jmp 0x62c05f
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00408244
jmp 0x62c05f
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00408164
jmp 0x62c05f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62c18e
mov eax, dword [ebp - 0x1c]
call fcn.004052c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62c1c8
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407070
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407070
ret
Function at 0x100010b4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov ax, word [0x10011208]
push ebx
push esi
push edi
mov word [ebp - 0x210], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.1000803c
cmp word [ebp - 0x210], 0x38
pop ecx
pop ecx
je 0x1000110f
cmp word [ebp - 0x210], 0x39
je 0x1000110f
cmp word [ebp - 0x210], 0x31
jne 0x1000117a
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ebx, str.SoftwareMicrosoftInternet_ExplorerBrowserEmulation
push str.MSCompatibilityMode
mov edi, SysReAllocString
push ebx
push edi
call fcn.100087ef
add esp, 0x10
cmp dword [ebp - 4], 1
je 0x1000117a
push 0x10010ff4
mov esi, 0x1000e0f0
push 0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x1000117a
push 0x10010ff4
push 0x1000e0ec
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push str.MSCompatibilityMode
push ebx
push edi
call fcn.1000881e
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x100013b4
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x10001d51
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push eax
push 0x10001d79
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x10001d97
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
and dword [ebp - 0x10], 0
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
mov ebx, str.SAIE
push eax
mov esi, str.Option
mov edi, 0x10010ed0
push ebx
push esi
mov ecx, edi
call fcn.100077d4
push 1
pop eax
cmp dword [ebp - 0x10], eax
jne 0x10001e64
push 0
push ebx
push esi
mov ecx, edi
call fcn.100077f0
and word [ebp - 0x428], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
push 0x10010ff4
lea eax, [ebp - 0x428]
push 0x104
push eax
call fcn.1000229b
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and word [ebp - 0x634], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x632]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x428]
push 0x1000e5c8
push eax
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x634]
push eax
push 0x1000e5c4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
and dword [0x10011218], 0
push 1
pop eax
jmp 0x10001e6f
cmp dword [ebp - 0x10], 0
jne 0x10001e6f
mov dword [0x10011218], eax
and word [ebp - 0x21c], 0
mov dword [ebp - 8], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21a]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 8]
push eax
push 0x10011208
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
mov esi, 0x208
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push ebx
mov dword [ebp - 0xc], esi
call edi
cmp word [ebp - 0x21c], 0
je 0x10001ef1
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10001ef1
lea eax, [ebp - 0x21c]
push eax
call fcn.10001fa2
test eax, eax
pop ecx
je 0x10001ef1
mov dword [ebp - 4], 1
and dword [ebp - 0x14], 0
push esi
lea eax, [ebp - 0x21c]
push 0
push eax
mov dword [ebp - 8], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 8]
push eax
push 0x10011208
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push ebx
call edi
xor esi, esi
cmp word [ebp - 0x21c], si
je 0x10001f61
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10001f61
lea eax, [ebp - 0x21c]
push eax
call fcn.10001fa2
test eax, eax
pop ecx
je 0x10001f61
push 1
pop eax
mov ecx, eax
jmp 0x10001f67
mov ecx, dword [ebp - 0x14]
push 1
pop eax
cmp dword [ebp - 4], esi
jne 0x10001f78
cmp ecx, esi
jne 0x10001f8f
mov dword [0x10011224], esi
jmp 0x10001f9d
cmp dword [ebp - 4], eax
jne 0x10001f8f
cmp ecx, eax
jne 0x10001f86
mov dword [0x10011224], eax
cmp ecx, esi
jne 0x10001f8f
mov dword [0x1001121c], eax
cmp ecx, eax
jne 0x10001f9d
cmp dword [ebp - 4], esi
jne 0x10001f9d
mov dword [0x10011220], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001fa2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10001fc1
push ebx
push esi
call dword [sym.imp.MSVCRT.dll__waccess]
pop ecx
test eax, eax
pop ecx
je 0x10001fc5
xor eax, eax
jmp 0x10002020
push edi
xor eax, eax
lea edi, [ebp - 0xf]
mov byte [ebp - 0x10], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1000e610
push esi
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x10002001
push edi
push 2
lea eax, [ebp - 0x10]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea eax, [ebp - 0x10]
push 0x1000e60c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
pop edi
jne 0x1000201e
push esi
call fcn.10009c3c
pop ecx
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x10002067
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 4
pop esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
and dword [ebp - 0x1c], 0
and dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 8]
mov ebx, str.SoftwareMicrosoftInternet_ExplorerBrowserEmulation
push eax
push str.MSCompatibilityMode
push ebx
push SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100020af
and dword [ebp - 0xc], 0
jmp 0x100020ba
push 1
pop eax
cmp dword [ebp - 0x1c], eax
je 0x100020ba
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
and dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push str.AllSitesCompatibilityMode
push ebx
push SysReAllocString
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100020eb
and dword [ebp - 0x10], 0
jmp 0x100020f8
cmp dword [ebp - 0x20], 0
je 0x100020f8
mov dword [ebp - 0x10], 1
lea eax, [ebp - 4]
and dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x24]
and dword [ebp - 0x24], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
push eax
push str.IntranetCompatibilityMode
mov esi, SysReAllocString
push ebx
push esi
call edi
test eax, eax
je 0x1000212e
xor eax, eax
push 1
mov dword [ebp - 0x14], eax
pop edi
jmp 0x1000213b
push 1
pop edi
cmp dword [ebp - 0x24], edi
je 0x10002139
mov dword [ebp - 0x14], edi
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x1000214f
cmp dword [ebp - 0x10], eax
jne 0x1000214f
cmp dword [ebp - 0x14], eax
mov dword [0x10011228], eax
je 0x10002155
mov dword [0x10011228], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
push ecx
push 0x20019
push eax
push str.SoftwareMicrosoftInternet_ExplorerBrowserEmulationClearableListData
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002194
push str.UserFilter
push dword [ebp - 0x18]
call fcn.10002199
pop ecx
test eax, eax
pop ecx
je 0x1000218b
mov dword [0x1001122c], edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002b82
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov ecx, dword [ebp + 8]
push edi
call fcn.10002c82
call fcn.10007ea4
and word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [0x10014780], 0
pop edi
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x104
push eax
je 0x10002bea
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
jmp 0x10002bf9
push 0x10011208
push str..html
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x210]
test eax, eax
je 0x10002c16
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.10002cb9
leave
ret

Function at 0x10002d4e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
mov esi, 0x400
push esi
lea eax, [ebp - 0x400]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x400]
push dword [ebp + 8]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x1c
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
leave
ret

Function at 0x100030e1
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 0xc]
push 0x2454
push 0
push esi
call sub.MSVCRT.dll_memset
lea eax, [esi + 8]
add esp, 0x18
mov dword [ebp - 0x38], eax
lea eax, [esi + 0x2148]
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
mov eax, 0x800
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x2348]
lea ecx, [esi + 0x1048]
mov dword [ebp - 0x20], eax
mov eax, 0x80
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 8], ecx
push eax
lea ecx, [esi + 0x2048]
push dword [ebp + 0x10]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x28], 0x100
push dword [ebp + 8]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x100031b8
mov eax, dword [ebp - 0x30]
cmp eax, 3
je 0x10003194
cmp eax, 4
je 0x10003194
cmp eax, 1
jne 0x100031b8
mov cx, word [ebp - 0x24]
and dword [esi + 0x2448], 0
and dword [esi + 0x244c], 0
or dword [esi + 0x2450], 0xffffffff
push 1
mov dword [esi + 4], eax
mov word [esi], cx
pop eax
jmp 0x100031ba
xor eax, eax
pop esi
leave
ret
Function at 0x100031bd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
jne 0x10003210
push ebx
mov ebx, str.MetalinkFile
lea eax, [esi + 0x5d538]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x10003204
and word [edi], 0
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
lea edi, [edi + eax*2]
push edi
call dword [sym.imp.MSVCRT.dll__wtol]
pop ecx
mov dword [esi + 0x2694], eax
pop ecx
mov ecx, esi
call fcn.10006bb4
test eax, eax
pop ebx
jne 0x10003214
xor eax, eax
jmp 0x10003254
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x2464], eax
je 0x10003251
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x100034fe
push edi
push edi
mov dword [esi + 0x5d100], 8
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x10003ef2
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [edi + 0x26e0]
pop ebx
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 2
cmp dword [eax + 4], ebx
je 0x10003f65
cmp dword [edi + 0x2480], 0
je 0x10003f87
push dword [esi + 0xc]
and dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2484]
push dword [edi + 0x2480]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x10003f56
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10003f87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10003f8b
jmp 0x10003f87
cmp dword [esi], 0
jne 0x10003f76
mov eax, dword [esi + 4]
test eax, eax
je 0x10003f76
mov dword [esi + 0x18], eax
jmp 0x10003f87
and dword [esi + 0x28], 0
push ebx
push ecx
mov ecx, edi
call fcn.10005401
test eax, eax
je 0x10003f8b
mov eax, ebx
jmp 0x10003f8d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4