joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50de20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x50de73
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x50deb0
sub edi, eax
cmp edi, edx
jbe 0x50de47
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call sub.MSVCR100.dll_memcpy
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0050d510
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x50dea9
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x50deb0
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.0050d510
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x50f180
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x56e030]
jne 0x50f18a
repz ret
jmp fcn.0050f53e
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x81a030]
jne 0x401116
repz ret
jmp fcn.00401c81

Function at 0x40848e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406852
and dword [ebp - 4], 0
cmp dword [0x81c814], 0
mov ebx, eax
jne 0x40853f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4085f0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4085f0
push eax
call fcn.004067e0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81c814], eax
call esi
push eax
call fcn.004067e0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81c818], eax
call esi
push eax
call fcn.004067e0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81c81c], eax
call esi
push eax
call fcn.004067e0
pop ecx
mov dword [0x81c824], eax
test eax, eax
je 0x40853f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004067e0
pop ecx
mov dword [0x81c820], eax
mov eax, dword [0x81c820]
cmp eax, ebx
je 0x408597
cmp dword [0x81c824], ebx
je 0x408597
push eax
call fcn.0040685b
push dword [0x81c824]
mov esi, eax
call fcn.0040685b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408597
test edi, edi
je 0x408597
call esi
test eax, eax
je 0x40858e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40858e
test byte [ebp - 0xc], 1
jne 0x408597
or dword [ebp + 0x10], 0x200000
jmp 0x4085d0
mov eax, dword [0x81c818]
cmp eax, ebx
je 0x4085d0
push eax
call fcn.0040685b
pop ecx
test eax, eax
je 0x4085d0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4085d0
mov eax, dword [0x81c81c]
cmp eax, ebx
je 0x4085d0
push eax
call fcn.0040685b
pop ecx
test eax, eax
je 0x4085d0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81c814]
call fcn.0040685b
pop ecx
test eax, eax
je 0x4085f0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4085f2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x81a030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2ffa114]
push ebx
mov ebx, dword [0x2ff9f60]
push esi
mov esi, dword [0x81b050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cc91
push 0x818c80
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ffa114]
mov dword [0x81c9ec], esi
cmp eax, 0x114e
jne 0x40ccbb
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.nanucucolumisocifozoguvex
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2ffa114]
cmp eax, 0x2f
jne 0x40ccdd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cba0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x40efa5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41aef0
push 0x41aee8
push str.FlsAlloc
push 0x1e
call fcn.0040eec3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40efd9
push dword [ebp + 8]
mov ecx, esi
call dword [0x4191ac]
call esi
jmp 0x40efdf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40f023
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41af00
push 0x41aef8
push str.FlsGetValue
push 0x20
call fcn.0040eec3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f05a
push dword [ebp + 8]
mov ecx, esi
call dword [0x4191ac]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40b468
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406147
mov dword [ebp - 0x14], eax
cmp dword [0x456594], esi
jne 0x40b55b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40b4e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b63b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40b63b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b63b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x456594], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x456598], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45659c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4565a4], eax
test eax, eax
je 0x40b558
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4565a0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b580
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b573
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40b595
push 4
pop eax
jmp 0x40b63d
cmp dword [ebp - 0x14], esi
je 0x40b595
push dword [0x456594]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b57a
mov eax, dword [0x4565a0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40b5f3
cmp dword [0x4565a4], edi
je 0x40b5f3
push eax
call ebx
push dword [0x4565a4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b5f3
test eax, eax
je 0x40b5f3
call ecx
test eax, eax
je 0x40b5e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b5e8
test byte [ebp - 8], 1
jne 0x40b5f3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40b623
mov eax, dword [0x456598]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
call eax
mov esi, eax
test esi, esi
je 0x40b620
mov eax, dword [0x45659c]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x456594]
call ebx
test eax, eax
je 0x40b63b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40b63d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ac6
mov esp, ebp
pop ebp
ret
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435030]
jne 0x40107a
repz ret
jmp fcn.00401ac1

Function at 0x409195
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bf5
and dword [ebp - 4], 0
cmp dword [0x437794], 0
mov ebx, eax
jne 0x409246
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092f7
push eax
call fcn.00404b83
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437794], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437798], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43779c], eax
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x4377a4], eax
test eax, eax
je 0x409246
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x4377a0], eax
mov eax, dword [0x4377a0]
cmp eax, ebx
je 0x40929e
cmp dword [0x4377a4], ebx
je 0x40929e
push eax
call fcn.00404bfe
push dword [0x4377a4]
mov esi, eax
call fcn.00404bfe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40929e
test edi, edi
je 0x40929e
call esi
test eax, eax
je 0x409295
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409295
test byte [ebp - 0xc], 1
jne 0x40929e
or dword [ebp + 0x10], 0x200000
jmp 0x4092d7
mov eax, dword [0x437798]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4092d7
mov eax, dword [0x43779c]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437794]
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b010
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x435030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c1501c]
push ebx
mov ebx, dword [0x2c14e68]
push esi
mov esi, dword [0x435f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b051
push str.pirebewaxamicafivojazirisibilig
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c1501c]
mov dword [0x4378f4], esi
cmp eax, 0x114e
jne 0x40b07b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.sosepukuvupafizafaguwiferayiv
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2c1501c]
cmp eax, 0x2f
jne 0x40b09d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040af50
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401070
add esp, 0x428
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402ee4
pop dword [ebp - 0x14]
mov eax, 0x432a41bf
sub eax, 0x42ea12db
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x4d46635a
add dword [ebp - 0x24], 0x10be1f1
mov dword [ebp - 0x20], 0x3ac48b44
add dword [ebp - 0x20], 0xf76ec101
mov dword [ebp - 0x1c], 0xbb0b1ce6
add dword [ebp - 0x1c], 0x91412748
mov dword [ebp - 0x18], 0x2041afee
add dword [ebp - 0x18], 0xdfbe5012
lea eax, [ebp - 0x24]
push eax
mov eax, 0xca24a660
add eax, 0x361bdaa4
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x9e692e6a
sub dword [ebp - 0x24], 0x29f6c514
mov dword [ebp - 0x20], 0x214cddd7
sub dword [ebp - 0x20], 0xdfe07c62
mov dword [ebp - 0x1c], 0xf9a6e2b0
add dword [ebp - 0x1c], 0x69c889bc
mov dword [ebp - 0x18], 0x8f3c914d
sub dword [ebp - 0x18], 0x8f3c914d
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x37577
push 0
call eax
mov ecx, 0x4939
xor edi, edi
add edi, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x14]
mov esi, 0x7fd270d
mov dword [ebp - 8], 0x10567162
mov ebx, dword [edx]
xor dword [ebp - 8], eax
sub ebx, esi
add dword [ebp - 0xc], 0x70b6fb80
mov dword [edi], ebx
add dword [ebp - 4], 0xd99eadda
add edi, 0x30cf06a9
add edi, 0xcf30f95b
add edx, 0x8b845768
sub edx, 0x8b845764
loop 0x402ff1
add eax, 0x6b5a9a5b
add eax, 0x94a67d5c
mov ebx, eax
add eax, 5
mov ecx, 0x7c81bbb7
add ecx, 0x83be4449
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x100253ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100253ba
pop dword [ebp - 0x40]
mov eax, 0x100253ba
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x7436b133
add dword [ebp - 0x50], 0xda1b9418
mov dword [ebp - 0x4c], 0x1b2068ca
sub dword [ebp - 0x4c], 0xe8ed1c85
mov dword [ebp - 0x48], 0xb551a62b
sub dword [ebp - 0x48], 0x690561fd
mov dword [ebp - 0x44], 0xffa3d0c3
add dword [ebp - 0x44], 0x5c2f3d
lea eax, [ebp - 0x50]
push eax
mov eax, 0x44f8a619
add eax, 0xcb0a4b73
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x76570095
sub dword [ebp - 0x50], 0x1e4973f
mov dword [ebp - 0x4c], 0x3dcb7096
add dword [ebp - 0x4c], 0x3a0f0df
mov dword [ebp - 0x48], 0xe447142d
add dword [ebp - 0x48], 0x7f28583f
mov dword [ebp - 0x44], 0xbadb35b3
add dword [ebp - 0x44], 0x4524ca4d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x46415
push 0
call eax
mov ecx, 0x4e41
mov edi, eax
mov ebx, 0x10046400
add ebx, dword [ebp - 0x40]
mov edx, 0x9a4a7003
add edx, 0x8d63006e
sub dword [ebp - 0x18], 0xcd4c0818
mov esi, dword [ebx]
add dword [ebp - 0x28], ecx
sub esi, edx
add dword [ebp - 8], 0xc738f3ed
mov dword [edi], esi
xor dword [ebp - 8], edi
add edi, 0x7033a757
add edi, 0x8fcc58ad
add ebx, 0xbb65c321
add ebx, 0x449a3ce3
loop 0x100254c6
add eax, 0x12bd7
mov ebx, eax
add eax, 0x894a5022
add eax, 0x76b5afe3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10001707
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x10014090]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.100028e0
mov esi, eax
test esi, esi
je 0x1000176d
cmp dword [esp + 0xc], ebx
je 0x10001766
push dword [esp + 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x100017fc
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
jmp 0x100017b1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.100028e0
mov esi, eax
test esi, esi
jne 0x10001813
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x10001788
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x100017db
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.100028e0
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x100017fa
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000c879
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x1000175a
Function at 0x10001b32
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1000dfb6
call fcn.1000dd63
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10001baf
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10001baf
call fcn.100012b3
mov esi, eax
jmp 0x10001cb5
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x10001bd2
call fcn.100012b3
jmp 0x10001ca8
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10001bc8
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x10001c05
mov esi, 0x8007000e
jmp 0x10001caa
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x10001cd8
jb 0x10001c20
cmp eax, 0xffffffff
ja 0x10001cd8
cmp eax, 0x400
jbe 0x10001c35
push eax
lea ecx, [ebp - 0x418]
call fcn.100028e0
jmp 0x10001c57
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10001c57
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10001bfb
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10001bc8
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.100028e0
mov esi, eax
test edi, edi
je 0x10001cb5
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10001cce
lea ecx, [ebp - 0x418]
call fcn.1000413e
mov eax, esi
call fcn.1000dcb8
ret 0x10
push 0x80070216
call fcn.100028e0
int3
Function at 0x100028e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100028ef
pop dword [ebp - 0x1c]
mov eax, 0xacc28641
sub eax, 0x9cc25d52
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x36c95
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3e95
mov edi, eax
mov ebx, 0xccde4ad
add ebx, 0x333df53
add ebx, dword [ebp - 0x1c]
mov esi, 0x9abc73a9
sub dword [ebp - 0x18], edx
mov edx, dword [ebx]
sub dword [ebp - 0x10], edi
xor edx, esi
add dword [ebp - 0x18], 0xb9663706
mov dword [edi], edx
mov dword [ebp - 0xc], 0x6638e057
add edi, 0x47cd2518
add edi, 0xb832daec
add ebx, 0x69b0e633
add ebx, 0x964f19d1
loop 0x1000293d
add eax, 0xf4ce958a
add eax, 0xb32579d
mov ebx, eax
add eax, 0x8945bad4
add eax, 0x76ba4531
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x100046d5
Capabilities:
Parse url

Disassembly:
push 0x4c
mov eax, 0x1000e1f1
call fcn.1000dcc4
mov dword [ebp - 0x1c], ecx
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x58]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x58], esi
push ebx
call fcn.100028e0
and dword [ebp - 4], 0
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 5
push ebx
call esi
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000485a
push 6
push ebx
mov byte [ebp - 4], 1
call esi
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x1000485a
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.100049e9
mov esi, dword [ebp - 0x14]
mov ebx, eax
test ebx, ebx
js 0x1000483f
lea ecx, [ebp - 0x18]
call fcn.100049e9
mov ebx, eax
test ebx, ebx
js 0x1000483f
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x40], 0
je 0x1000483a
mov ebx, dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push esi
call ebx
cmp eax, 0x8000
ja 0x1000483a
push esi
call ebx
cmp eax, 6
jb 0x1000483a
lea ecx, [ebp - 0x14]
call fcn.100049e9
mov ebx, eax
test ebx, ebx
js 0x1000483f
push str.http:
lea ecx, [ebp - 0x10]
call fcn.100028e0
test al, al
je 0x100047c1
push str.https:
lea ecx, [ebp - 0x18]
call fcn.100028e0
test al, al
jne 0x1000483a
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x18], eax
movzx eax, word [eax]
test ax, ax
je 0x1000483a
mov ecx, eax
cmp cx, 0xd
je 0x1000483a
cmp cx, 0xa
je 0x1000483a
mov dword [ebp - 0x1c], 0x2f
lea eax, [edx + 1]
cmp word [ebp - 0x1c], cx
cmovne eax, edx
mov edx, eax
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x100047d3
cmp edx, 3
jb 0x1000483a
xor eax, eax
inc eax
push esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x50], eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea ecx, [ebp - 0x58]
push ecx
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x1000483f
mov ebx, 0x80070057
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [ebp - 0x10]
call edi
push esi
call edi
mov eax, ebx
call fcn.1000dc98
ret 4
push 0x8007000e
call fcn.100028e0
int3