joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1016f188
mov dword [ebp - 0x8c], 0x740068
lea esi, [ebp - 0x8c]
mov dword [ebp - 0x88], 0x700074
push edi
mov dword [ebp - 0x84], 0x3a0073
mov edx, 0x400
mov dword [ebp - 0x80], 0x2f002f
sub esi, eax
mov dword [ebp - 0x7c], 0x690062
mov dword [ebp - 0x78], 0x68007a
mov dword [ebp - 0x74], 0x2e0069
mov dword [ebp - 0x70], 0x680073
mov dword [ebp - 0x6c], 0x6e0061
mov dword [ebp - 0x68], 0x750068
mov dword [ebp - 0x64], 0x650074
mov dword [ebp - 0x60], 0x680063
mov dword [ebp - 0x5c], 0x63002e
mov dword [ebp - 0x58], 0x2f006e
mov dword [ebp - 0x54], 0x69006c
mov dword [ebp - 0x50], 0x650076
mov dword [ebp - 0x4c], 0x63002f
mov dword [ebp - 0x48], 0x6c006f
mov dword [ebp - 0x44], 0x65006c
mov dword [ebp - 0x40], 0x740063
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x2f006e
mov dword [ebp - 0x34], 0x610063
mov dword [ebp - 0x30], 0x63006e
mov dword [ebp - 0x2c], 0x6c0065
mov dword [ebp - 0x28], 0x6f0043
mov dword [ebp - 0x24], 0x6c006c
mov dword [ebp - 0x20], 0x630065
mov dword [ebp - 0x1c], 0x690074
mov dword [ebp - 0x18], 0x6e006f
mov dword [ebp - 0x14], 0x77003f
mov dword [ebp - 0x10], 0x640069
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
nop
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x1003568e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003568e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10035670
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x1016f188
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x10036000
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
push 0
mov dword [ebp - 4], edi
mov dword [edi + 4], vtable.IHttpTaskCallback.0
mov dword [edi], vtable.FullScreenAdConfigTask.0
mov dword [edi + 4], vtable.FullScreenAdConfigTask.1.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.100f831a
mov edx, eax
mov dword [edi + 0x13a4], 0xffffffff
add esp, 4
mov dword [edi + 0x24], edx
mov ecx, 1
lea esi, [edi + 0x28]
mov eax, edx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
inc ecx
mov dword [esi - 4], edx
cmp ecx, 0x270
jl 0x10036064
mov dword [edi + 0x20], 0x270
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10036340
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x1003639e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x10036360
mov eax, dword [edi]
jmp 0x10036489
cmp eax, 0x4e0
jb 0x10036489
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x100363c0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10036410
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10036860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10170188
mov dword [ebp - 0x78], 0x740068
lea esi, [ebp - 0x78]
mov dword [ebp - 0x74], 0x700074
push edi
mov dword [ebp - 0x70], 0x2f003a
mov edx, 0x400
mov dword [ebp - 0x6c], 0x77002f
sub esi, eax
mov dword [ebp - 0x68], 0x2e0070
mov dword [ebp - 0x64], 0x680073
mov dword [ebp - 0x60], 0x6e0061
mov dword [ebp - 0x5c], 0x750068
mov dword [ebp - 0x58], 0x650074
mov dword [ebp - 0x54], 0x680063
mov dword [ebp - 0x50], 0x63002e
mov dword [ebp - 0x4c], 0x2f006e
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x660074
mov dword [ebp - 0x40], 0x67002f
mov dword [ebp - 0x3c], 0x740065
mov dword [ebp - 0x38], 0x640041
mov dword [ebp - 0x34], 0x6e0049
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x760072
mov dword [ebp - 0x28], 0x6c0061
mov dword [ebp - 0x24], 0x690054
mov dword [ebp - 0x20], 0x65006d
mov dword [ebp - 0x1c], 0x63003f
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x6e006e
mov dword [ebp - 0x10], 0x6c0065
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
nop dword [eax]
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x1003696e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003696e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10036950
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x10170188
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x100369a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x58], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x58]
mov eax, 0x10170988
mov dword [ebp - 0x54], 0x700074
push edi
mov dword [ebp - 0x50], 0x2f003a
mov edx, 0x400
mov dword [ebp - 0x4c], 0x77002f
sub esi, eax
mov dword [ebp - 0x48], 0x2e0070
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x6e0061
mov dword [ebp - 0x3c], 0x750068
mov dword [ebp - 0x38], 0x650074
mov dword [ebp - 0x34], 0x680063
mov dword [ebp - 0x30], 0x63002e
mov dword [ebp - 0x2c], 0x2f006e
mov dword [ebp - 0x28], 0x6e0069
mov dword [ebp - 0x24], 0x660074
mov dword [ebp - 0x20], 0x46002f
mov dword [ebp - 0x1c], 0x6c0069
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x550072
mov dword [ebp - 0x10], 0x650073
mov dword [ebp - 0xc], 0x330072
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x10036a72
movzx ecx, word [esi + eax]
test cx, cx
je 0x10036a72
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10036a54
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x10170988
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x10036aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1016f988
mov dword [ebp - 0x74], 0x740068
lea esi, [ebp - 0x74]
mov dword [ebp - 0x70], 0x700074
push edi
mov dword [ebp - 0x6c], 0x2f003a
mov edx, 0x400
mov dword [ebp - 0x68], 0x77002f
sub esi, eax
mov dword [ebp - 0x64], 0x2e0070
mov dword [ebp - 0x60], 0x680073
mov dword [ebp - 0x5c], 0x6e0061
mov dword [ebp - 0x58], 0x750068
mov dword [ebp - 0x54], 0x650074
mov dword [ebp - 0x50], 0x680063
mov dword [ebp - 0x4c], 0x63002e
mov dword [ebp - 0x48], 0x2f006e
mov dword [ebp - 0x44], 0x6e0069
mov dword [ebp - 0x40], 0x660074
mov dword [ebp - 0x3c], 0x67002f
mov dword [ebp - 0x38], 0x740065
mov dword [ebp - 0x34], 0x750046
mov dword [ebp - 0x30], 0x6c006c
mov dword [ebp - 0x2c], 0x630053
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x6e0065
mov dword [ebp - 0x20], 0x640041
mov dword [ebp - 0x1c], 0x63003f
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x6e006e
mov dword [ebp - 0x10], 0x6c0065
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x10036ba4
movzx ecx, word [esi + eax]
test cx, cx
je 0x10036ba4
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10036b86
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x1016f988
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
Function at 0x10039770
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10124cd2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10167c60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x100397cc
mov dword [esi], 0x101335c8
mov dword [esi + 0x10], 0x101335d0
mov dword [esi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
push 0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.100287c0
lea edx, [esi + 0x10]
mov dword [ebp + 0xc], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100c456e
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1003985c
push 1
mov byte [ebp - 4], 5
call fcn.10086e3d
add esp, 4
mov dword [ebx + 4], eax
jmp 0x1003985e
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10039910
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jl 0x10039930
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x1003b040
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10124da6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x78]
test eax, eax
jne 0x1003b1e6
push str.RecommStWnd_start_init_web_view
call fcn.10061520
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100e67c0
add esp, 0x10
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x219]
call fcn.1003a260
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.100088b0
mov ecx, eax
test ecx, ecx
je 0x1003b205
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x220]
call fcn.10016a90
test al, al
jne 0x1003b142
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b120
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.1000b940
mov esi, dword [ebp - 0x220]
mov dword [ebp - 4], 1
test esi, esi
je 0x1003b1ae
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003b1ae
push esi
call fcn.1009bdb0
add esp, 4
test eax, eax
je 0x1003b1ae
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1003b1ae
push str.GetWebViewFactory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003b18d
call eax
mov dword [edi + 0x78], eax
push str.IWebViewToIWebViewEx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsSupportedWebViewEngine
push ebx
mov dword [edi + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x80], eax
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1003b1cd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x78]
test eax, eax
jne 0x1003b1e6
push str.RecommStWnd_Init_View_Helper_fail
call fcn.10061520
mov eax, dword [edi + 0x78]
add esp, 4
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008520
int3
Function at 0x1003b8a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0
push 0
push dword [ebp + 0xc]
mov esi, ecx
push str.open
push dword [esi - 0x6c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1003b8ec
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x13d4]
test eax, eax
je 0x1003b8e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x13d4], 0
lea ecx, [esi - 0x70]
call fcn.1003be90
pop esi
pop ebp
ret 8

Function at 0x1003bd50
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.fsa:_OnWndCreate.
mov edi, ecx
call fcn.10061520
add esp, 4
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 3
push 0
push 0
push 0
push 0
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov eax, dword [edi + 0x1454]
test eax, eax
je 0x1003bdb8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x1454], esi
mov ecx, edi
pop edi
pop esi
jmp fcn.1003b380
Function at 0x100401f0
Capabilities:
Create thread

Disassembly:
push esi
push str.StartGet
mov esi, ecx
call fcn.10061520
add esp, 4
cmp dword [esi + 0x14], 0
jne 0x1004024b
cmp dword [esi + 0x18], 0
jne 0x1004024b
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x1004024b
push str.start_get_begin
call fcn.10061520
add esp, 4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x10040270
push 0
push 0
mov dword [esi + 0x18], eax
call fcn.100ee4df
add esp, 0x18
mov dword [esi + 0x14], eax
pop esi
ret

Function at 0x10040700
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov eax, dword [esi + 0x30]
sub eax, dword [esi + 0x2c]
sar eax, 4
test eax, eax
je 0x10040780
xor edi, edi
mov dword [ebp - 8], edi
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10040780
mov ebx, dword [esi + 0x2c]
add ebx, edi
push dword [ebx + 4]
lea edi, [ebx + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push dword [esi + 0x28]
lea eax, [ebx + 0xc]
push 0x4e20
push 0
push eax
push edi
call fcn.1003e630
add esp, 0x14
test eax, eax
je 0x100407e9
mov eax, dword [esi + 0x30]
mov ebx, dword [ebp - 4]
sub eax, dword [esi + 0x2c]
inc ebx
mov edi, dword [ebp - 8]
add edi, 0x10
sar eax, 4
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
cmp ebx, eax
jb 0x10040724
mov eax, dword [esi + 0x30]
xor edi, edi
mov ecx, dword [esi + 0x2c]
sub eax, ecx
sar eax, 4
test eax, eax
je 0x100407ba
xor ebx, ebx
push 1
push dword [ebx + ecx + 8]
push dword [ebx + ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x100407e9
mov eax, dword [esi + 0x30]
inc edi
mov ecx, dword [esi + 0x2c]
add ebx, 0x10
sub eax, ecx
sar eax, 4
cmp edi, eax
jb 0x10040793
mov ebx, 1
cmp dword [esi + 0x18], 0
jne 0x100407e2
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100407e2
push dword [esi + 0x1c]
push ebx
push dword [esi + 0x14]
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
jmp 0x100407bf

Function at 0x10040850
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
jne 0x10040896
cmp dword [esi + 0x28], 0
jne 0x10040896
mov eax, dword [esi + 0x30]
sub eax, dword [esi + 0x2c]
test eax, 0xfffffff0
je 0x10040896
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x1003c600
push 0
push 0
mov dword [esi + 0x28], eax
call fcn.100ee4df
add esp, 0x18
mov dword [esi + 0x24], eax
pop esi
ret
Function at 0x100415f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10125519
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x58], 0
call fcn.100088b0
mov ecx, eax
test ecx, ecx
je 0x100416ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push esi
push 0x71
mov dword [ebp - 4], 0
mov dword [ebp - 0x58], 1
call fcn.100132d0
xor eax, eax
mov dword [ebp - 0x54], 0x360033
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x54]
push eax
push esi
mov dword [ebp - 0x50], 0x770030
mov dword [ebp - 0x4c], 0x5c0070
mov dword [ebp - 0x48], 0x610062
mov dword [ebp - 0x44], 0x6b0063
mov dword [ebp - 0x40], 0x720067
mov dword [ebp - 0x3c], 0x75006f
mov dword [ebp - 0x38], 0x64006e
mov dword [ebp - 0x34], 0x650044
mov dword [ebp - 0x30], 0x610066
mov dword [ebp - 0x2c], 0x6c0075
mov dword [ebp - 0x28], 0x5f0074
mov dword [ebp - 0x24], 0x690062
mov dword [ebp - 0x20], 0x640072
mov dword [ebp - 0x1c], 0x6a002e
mov dword [ebp - 0x18], 0x670070
call fcn.100131f0
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008520
int3

Function at 0x10041800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10125599
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x58], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x54], 0
call fcn.100088b0
mov ecx, eax
test ecx, ecx
je 0x10041909
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push esi
push 0x71
mov dword [ebp - 4], 0
mov dword [ebp - 0x54], 1
call fcn.100132d0
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x360033
push eax
push esi
mov dword [ebp - 0x4c], 0x770030
mov dword [ebp - 0x48], 0x5c0070
mov dword [ebp - 0x44], 0x610062
mov dword [ebp - 0x40], 0x6b0063
mov dword [ebp - 0x3c], 0x720067
mov dword [ebp - 0x38], 0x75006f
mov dword [ebp - 0x34], 0x64006e
mov dword [ebp - 0x30], 0x650044
mov dword [ebp - 0x2c], 0x610066
mov dword [ebp - 0x28], 0x6c0075
mov dword [ebp - 0x24], 0x5f0074
mov dword [ebp - 0x20], 0x790073
mov dword [ebp - 0x1c], 0x2e0073
mov dword [ebp - 0x18], 0x70006a
mov dword [ebp - 0x14], 0x67
call fcn.100131f0
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008520
int3