joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456cf0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x5a05c4]
mov ebx, dword [ebp + 8]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov eax, 0x20019
or eax, dword [ecx + 4]
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0
push ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x456d7f
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x456d7f
cmp dword [ebp - 0x18], 0
mov edi, 0x91
jne 0x456d7f
push 0
push dword [esi + 4]
push ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x456dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edx, dword [0x5a05c4]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
xor edx, ebp
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x456e28
mov eax, dword [ebp - 0x10]
mov esi, 0x3f4
add eax, 0xfffffffd
cmp eax, 1
ja 0x456e28
cmp dword [ebp - 0x14], 4
jne 0x456e28
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00527311
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x456e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov edx, dword [0x5a05c4]
mov eax, dword [ebp + 8]
lea esi, [esp + 8]
lea edi, [esp + 0x10]
xor edx, ebp
mov dword [esp + 0x14], edx
lea edx, [esp + 4]
mov dword [esp + 0x10], 0xb
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 8
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x456ee1
mov eax, dword [esp + 0x10]
mov esi, 0x3f4
or eax, 8
cmp eax, 0xb
jne 0x456ee1
cmp dword [esp + 4], 8
jne 0x456ee1
mov eax, dword [ebp + 0xc]
movsd xmm0, qword [esp + 8]
xor esi, esi
movsd qword [eax], xmm0
mov ecx, dword [esp + 0x14]
xor ecx, ebp
call fcn.00527311
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 8
Function at 0x456f00
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00527850
mov edx, dword [0x5a05c4]
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x810]
lea esi, [ebp - 0x1014]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x1018]
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
push edx
push ebx
push esi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x456fab
mov eax, dword [ebp - 0x1014]
mov edi, dword [ebp + 0xc]
cmp eax, 2
je 0x456f75
mov esi, 0x3f4
cmp eax, 1
jne 0x456fab
mov ecx, edi
push ebx
jmp 0x456fa4
lea eax, [ebp - 0x1010]
push 0x400
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
dec eax
mov esi, 0xea
cmp eax, 0x3ff
ja 0x456fab
mov ecx, edi
lea eax, [ebp - 0x1010]
push eax
call fcn.00427f50
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x456fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov edx, dword [0x5a05c4]
mov eax, dword [ebp + 8]
xor edx, ebp
mov dword [ebp - 8], edx
lea edx, [ebp + 0xc]
push 4
push edx
push 4
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
mov esi, eax
xor ecx, ebp
call fcn.00527311
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8

Function at 0x457030
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
push ebx
call fcn.00542114
add esp, 4
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x457210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x5a05c4]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx], 0
je 0x457311
cmp dword [esi + 4], 0
js 0x457311
cmp byte [esi + 0x13], 0
lea ecx, [esi + 8]
mov edx, 4
jns 0x45724f
mov edx, SysReAllocString
and edx, dword [esi + 0x10]
dec edx
mov dword [ebp - 0x14], edx
lea eax, [esi + 0x14]
lea edi, [esi + 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], eax
mov ebx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
sub eax, ebx
add eax, 0xfffffffe
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [ebp - 0x2c], eax
push edx
mov dword [ebp - 0x28], ecx
push ecx
call fcn.00447f50
add esp, 8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], edi
push edi
mov edi, dword [ebp - 0x2c]
push ebx
push edi
push 0
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x45730d
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 0x14]
mov edx, ecx
inc eax
sub edx, ebx
shr eax, 1
sar edx, 1
sub eax, edx
jb 0x4572d1
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x16]
mov word [ebp - 0x16], 0
inc eax
push edx
push eax
call fcn.004575c0
mov ebx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov edx, dword [ebp - 0x24]
sub ecx, ebx
mov eax, 0x4000
add ecx, 0xfffffffe
mov dword [esi + 0x20], ecx
cmp dword [ebp - 0x14], edx
cmovne eax, edx
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 0x28]
call fcn.00447f50
add esp, 8
push dword [ebp - 0x20]
push ebx
push edi
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x457346
cmp byte [esi + 0x13], 0
lea eax, [esi + 8]
jns 0x45731c
mov eax, dword [eax]
mov word [eax], 0
xor ebx, ebx
mov eax, dword [esi + 0x14]
mov word [eax], 0
mov dword [esi + 0x20], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov bl, 1
mov eax, dword [eax]
mov ecx, dword [ecx]
inc eax
and eax, 0xfffffffe
mov word [ecx + eax], 0
jmp 0x457332

Function at 0x4573c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
dec dword [ecx + 4]
pop ebp
jmp fcn.00457210
Function at 0x4573f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [0x5a05c4]
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edx, 0x20019
or edx, dword [ebp + 0x10]
push esi
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x457457
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x457477
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x45745d
test eax, eax
js 0x45745d
mov dword [ebp - 0x14], 0x104
lea edx, [esi + 8]
lea ebx, [ebp - 0x14]
push edi
push 0
push 0
push 0
push ebx
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x45745d
jmp 0x457463

Function at 0x457550
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5a05c4]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
lea ecx, [edx - 1]
test edx, edx
mov dword [esi + 4], ecx
jle 0x45759d
test eax, eax
je 0x45759d
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x104
lea edx, [esi + 8]
lea ebx, [ebp - 0x14]
push edi
push 0
push 0
push 0
push ebx
push edx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4575a3
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x459c70
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x5a05c4]
xorpd xmm0, xmm0
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x5a2100]
ucomisd xmm1, xmm0
jne 0x459df4
jp 0x459df4
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x5a4294]
mov edx, dword fs:[0x2c]
mov eax, dword [0x5a2110]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x459e19
mov ecx, dword [0x5a4294]
mov edx, dword fs:[0x2c]
mov eax, dword [0x5a2120]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x459e52
rdtsc
lea esi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x5a2118]
movsd xmm2, qword [0x55ee50]
sbb ebx, dword [0x5a211c]
movd xmm1, edi
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movd xmm0, ebx
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x557210]
subpd xmm1, xmmword [0x557220]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorpd xmm1, xmm1
divsd xmm0, qword [esp + 0x20]
ucomisd xmm2, xmm0
ja 0x459df4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub eax, dword [0x5a2108]
sbb ecx, dword [0x5a210c]
movd xmm2, eax
movd xmm1, ecx
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x557210]
subpd xmm2, xmmword [0x557220]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x5a2100], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00527311
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5a2110
call fcn.00527357
add esp, 4
cmp dword [0x5a2110], 0xffffffff
jne 0x459ce2
rdtsc
mov dword [0x5a2108], eax
mov dword [0x5a210c], edx
push 0x5a2110
call fcn.005273cd
add esp, 4
jmp 0x459ce2
push 0x5a2120
call fcn.00527357
add esp, 4
cmp dword [0x5a2120], 0xffffffff
jne 0x459d03
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x5a211c], ecx
mov dword [0x5a2118], eax
push 0x5a2120
call fcn.005273cd
add esp, 4
jmp 0x459d03
Function at 0x45cfdc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x5a05c4]
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
xor eax, ebp
mov ecx, edi
mov dword [esp + 0xd8], eax
xor eax, eax
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
mov dword [esp + 0xd0], eax
cmp byte [edi + 0xb], 0
jns 0x45d022
mov ecx, dword [edi]
lea edx, [esp + 0xb0]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x45d0c4
push edi
call fcn.00453290
add esp, 4
movzx eax, al
mov ecx, edi
xor eax, 5
cmp byte [edi + 0xb], 0
jns 0x45d053
mov ecx, dword [edi]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x45d10f
push 0x3a
push str..._.._chrome_installer_util_delete_after_reboot_helper.cc
call fcn.0043e610
add esp, 8
mov bl, 1
test eax, eax
jle 0x45d176
lea esi, [esp + 8]
mov ecx, esi
push 0xffffffffffffffff
push 0x5d
push str..._.._chrome_installer_util_delete_after_reboot_helper.cc
call fcn.0043e680
lea eax, [esp + 0xc]
push 0x18
push str.Scheduled_for_deletion:
push eax
call fcn.004058b5
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x45d0ae
mov edi, dword [edi]
push edi
push eax
call fcn.0043f290
add esp, 8
mov ecx, esi
call fcn.0043ea30
jmp 0x45d176
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x45d174
call fcn.0043ef80
lea esi, [esp + 8]
mov ecx, esi
push eax
push 1
push 0x3e
push str..._.._chrome_installer_util_delete_after_reboot_helper.cc
call fcn.0043f140
cmp byte [edi + 0xb], 0
lea eax, [esp + 0x10]
jns 0x45d0fc
mov edi, dword [edi]
push edi
push eax
call fcn.0043f290
add esp, 8
push 0x10
push str._does_not_exist.
jmp 0x45d164
push 2
call fcn.0043e5e0
add esp, 4
test al, al
je 0x45d174
call fcn.0043ef80
lea esi, [esp + 8]
mov ecx, esi
push eax
push 2
push 0x49
push str..._.._chrome_installer_util_delete_after_reboot_helper.cc
call fcn.0043f140
lea eax, [esp + 0x10]
push 0x13
push str.Could_not_schedule
push eax
call fcn.004058b5
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x45d153
mov edi, dword [edi]
push edi
push eax
call fcn.0043f290
add esp, 8
push 0xe
push str._for_deletion.
push eax
call fcn.004058b5
add esp, 0xc
mov ecx, esi
call fcn.0043f200
xor ebx, ebx
mov ecx, dword [esp + 0xd8]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45da7d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x5a05c4]
mov ecx, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
cmp edi, eax
mov dword [ebp - 0x34], eax
je 0x45dabd
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebp + 8]
sub ebx, edi
lea esi, [eax + 0xc]
add edi, 0xffffffe8
mov ecx, esi
push edi
call fcn.0045e1be
add edi, 0xffffffe8
add ebx, 0x18
jne 0x45daad
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov dword [eax + 4], ecx
mov ecx, esi
push 1
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004566a0
mov eax, dword [esi]
test eax, eax
je 0x45db58
lea esi, [ebp - 0x2c]
xor edi, edi
lea ebx, [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebx], edi
mov dword [esi + 8], edi
mov ecx, esi
push 1
call fcn.0040b27c
lea eax, [ebp - 0x30]
push ebx
mov ebx, eax
push dword [esi]
push eax
push edi
mov edi, dword [ebp - 0x34]
push str.PendingFileRenameOperations
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x45db5f
cmp eax, 0xea
jne 0x45db85
cmp dword [ebp - 0x30], 7
mov esi, 0x8000ffff
jne 0x45db93
mov ecx, dword [ebp - 0x20]
test cl, 1
jne 0x45db93
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edx, ecx
sub esi, eax
sub edx, esi
jbe 0x45db66
lea esi, [ebp - 0x2c]
mov ecx, esi
push edx
call fcn.0040b27c
mov eax, dword [esi]
lea edx, [ebp - 0x20]
jmp 0x45db70
mov esi, 0x80070002
jmp 0x45dba6
mov esi, 0x80070002
jmp 0x45db93
lea edx, [ebp - 0x20]
jae 0x45db70
add ecx, eax
mov dword [ebp - 0x28], ecx
push edx
push eax
push ebx
push 0
push str.PendingFileRenameOperations
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45dbc2
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x45dba6
mov dword [ebp - 0x28], eax
push eax
call fcn.005272d6
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.004568a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
push dword [ebp + 8]
push ecx
push eax
call fcn.0045d5ab
add esp, 0xc
mov esi, eax
jmp 0x45db93
Function at 0x45e300
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x5a05c4]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x5a2168]
test eax, eax
je 0x45e402
mov esi, ecx
push str.ShowHTMLDialog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45e402
mov dword [esp + 0x2c], 0
lea ecx, [esi + 4]
mov dword [esp + 4], eax
cmp byte [esi + 0xf], 0
jns 0x45e351
mov ecx, dword [ecx]
xor ebx, ebx
lea edi, [esp + 0x2c]
push 1
push edi
push ecx
push ebx
call sub.urlmon.dll_CreateURLMonikerEx
cmp dword [edi], ebx
je 0x45e459
mov ebx, dword [ebp + 8]
mov dword [esp + 0x28], 0
test ebx, ebx
je 0x45e3a8
mov eax, dword [ebx]
lea edx, [esp + 0x28]
mov ecx, ebx
push edx
call dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x45e2a0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
test eax, eax
mov dword [0x5a2164], eax
je 0x45e3a8
mov dword [0x5a216c], ebx
cmp byte [esi + 0x1b], 0
lea eax, [esi + 0x10]
jns 0x45e3b3
mov eax, dword [eax]
lea ebx, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.004a63f0
lea edi, [esp + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
push dword [esp + 0x2c]
push ebx
mov ebx, edi
push dword [esp + 0x38]
push 0
call dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movzx eax, word [ebx]
cmp ax, 8
je 0x45e406
mov ecx, dword [ebp + 0xc]
cmp ax, 3
jne 0x45e428
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0x45e428
xor ebx, ebx
jmp 0x45e459
mov eax, dword [ebp + 0xc]
add esi, 0x1c
mov dword [eax], 6
push dword [esp + 0x10]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, esi
push eax
push dword [esp + 0x14]
call fcn.004278e0
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [0x5a2164]
test eax, eax
je 0x45e44b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov dword [0x5a216c], eax
mov dword [0x5a2164], eax
test edi, edi
lea ecx, [esp + 0x18]
setns bl
call fcn.004a63e0
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x461cd8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x208
mov eax, dword [0x5a05c4]
lea edi, [ebp - 0x210]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x214]
mov dword [eax], 0x100
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
test eax, eax
je 0x461d40
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x461d40
mov esi, dword [ebp + 8]
mov ecx, esi
push eax
call fcn.00427a30
mov ecx, esi
push 0x2e
push 1
call fcn.00427f72
mov eax, dword [ebp - 0x214]
mov ecx, esi
dec eax
push eax
push edi
call fcn.00427c14
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x208
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46bbb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [0x5a05c4]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
mov dword [esp + 0x18], ecx
push eax
call fcn.0046bd13
add esp, 4
mov ecx, dword [0x5a21ac]
mov ebx, eax
test ecx, ecx
je 0x46bbf3
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 4]
jmp 0x46bcb6
call fcn.0046bd61
add ebx, dword [eax + 0x18]
mov edi, dword [0x5a5578]
mov eax, ebx
shr eax, 4
inc eax
movzx eax, ax
push 6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46bca5
mov esi, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46bca5
mov dword [esp + 4], edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x46bca5
mov edi, eax
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setg cl
and ebx, 0xf
je 0x46bc6e
test eax, eax
jle 0x46bc6e
mov edx, edi
dec ebx
add edx, eax
movzx eax, word [edi]
lea edi, [edi + eax*2 + 2]
cmp edi, edx
setb cl
add ebx, 0xffffffff
jae 0x46bc6e
cmp edi, edx
jb 0x46bc59
xor eax, eax
test cl, cl
mov ecx, 0
mov edx, 0
je 0x46bcab
movzx ebx, word [edi]
test ebx, ebx
je 0x46bca5
xor eax, eax
add edi, 2
cmp bx, 5
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
jae 0x46bccb
lea eax, [esp + 8]
mov byte [eax + 0xb], bl
jmp 0x46bcef
xor eax, eax
xor ecx, ecx
xor edx, edx
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00527311
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.00527256
add esp, 4
or esi, 0x80000000
mov dword [esp + 8], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
lea ecx, [ebx + ebx]
push ecx
push edi
push eax
mov esi, eax
call fcn.0052acc0
add esp, 0xc
mov word [esi + ebx*2], 0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
jmp 0x46bcab

Function at 0x46f8c8
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046f5e8
Function at 0x46fbdd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046f8d4

Function at 0x472490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x47249f
test eax, eax
jne 0x4724cf
cmp byte [0x5a21ec], 1
jne 0x4724cf
push dword [0x5a21f0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4724cf
push eax
call fcn.0040cc30
add esp, 4
push 0
push dword [0x5a21f0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
ret 0xc
Function at 0x4745ae
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
xor eax, eax
mov ecx, 8
mov edx, eax
mov esi, edx
and edx, 1
neg edx
shr esi, 1
and edx, 0xedb88320
xor edx, esi
dec ecx
jne 0x4745bb
mov dword [eax*4 + 0x5a2260], edx
inc eax
cmp eax, 0x100
jne 0x4745b4
mov eax, 0xffffe400
mov ecx, dword [eax + 0x5a3e60]
movzx edx, cl
shr ecx, 8
xor ecx, dword [edx*4 + 0x5a2260]
mov dword [eax + 0x5a4260], ecx
add eax, 4
jne 0x4745e3
mov eax, 0x4b85d0
mov dword [0x5a4264], 0x4b86b0
mov dword [0x5a4268], eax
mov dword [0x5a4260], eax
call fcn.004b88b6
test eax, eax
jne 0x47462d
mov dword [0x5a4260], 0x4b86b0
pop esi
pop ebp
ret