joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403042
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402fff
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40301d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40307b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
or byte [eax], al
add byte [eax], al
inc eax
or byte [eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x403062
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40306b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x403075
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x403057
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402fe1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4030c8
dec eax
je 0x4030bf
sub eax, 3
je 0x4030b6
mov dword [ebp - 4], 0x40
jmp 0x4030e5
mov dword [ebp - 4], 4
jmp 0x4030cb
mov dword [ebp - 4], 0x20
jmp 0x4030cb
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x403117
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x403097
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00402928
std
dec ebp
push es
mov eax, dword [0x6a1475ff]
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x403123
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4031ed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0

Function at 0x403db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esp
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00402928
pop ss
mov esp, 0x858de62a
aam 0xf8
invalid
Function at 0x401ab5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e090]
jne 0x401abf
repz ret
jmp fcn.00402aa8

Function at 0x409c2e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004065a0
and dword [ebp - 4], 0
cmp dword [0x432278], 0
mov ebx, eax
jne 0x409cdf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409d90
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409d90
push eax
call fcn.0040652e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x432278], eax
call esi
push eax
call fcn.0040652e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43227c], eax
call esi
push eax
call fcn.0040652e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x432280], eax
call esi
push eax
call fcn.0040652e
pop ecx
mov dword [0x432288], eax
test eax, eax
je 0x409cdf
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040652e
pop ecx
mov dword [0x432284], eax
mov eax, dword [0x432284]
cmp eax, ebx
je 0x409d37
cmp dword [0x432288], ebx
je 0x409d37
push eax
call fcn.004065a9
push dword [0x432288]
mov esi, eax
call fcn.004065a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409d37
test edi, edi
je 0x409d37
call esi
test eax, eax
je 0x409d2e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409d2e
test byte [ebp - 0xc], 1
jne 0x409d37
or dword [ebp + 0x10], 0x200000
jmp 0x409d70
mov eax, dword [0x43227c]
cmp eax, ebx
je 0x409d70
push eax
call fcn.004065a9
pop ecx
test eax, eax
je 0x409d70
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409d70
mov eax, dword [0x432280]
cmp eax, ebx
je 0x409d70
push eax
call fcn.004065a9
pop ecx
test eax, eax
je 0x409d70
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432278]
call fcn.004065a9
pop ecx
test eax, eax
je 0x409d90
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409d92
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b30
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x414060]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x74]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
push esi
push edi
push 0x50
mov esi, ecx
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
call fcn.00405a40
xor eax, eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
lea edi, [ebp + 0x14]
lea ebx, [ebp + 4]
mov dword [ebx + 0xc], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
xor ecx, ecx
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
add esp, 0xc
cmp esi, ecx
mov dword [edi + 0x1c], eax
mov byte [edi + 0x20], al
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
jle 0x401bdf
push ecx
push esi
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esi*8]
push ebp
mov ecx, esi
call fcn.00401920
push ebx
lea esi, [esp + 0x1c]
mov ecx, ebp
call fcn.004019c0
xor esi, esi
lea ecx, [ecx]
movzx eax, byte [ebx + esi]
push eax
push str._02x
push 3
push edi
call fcn.00404e77
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jb 0x401bf0
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404bf2
add esp, 0x6c
ret 8

Function at 0x401d70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov eax, ebp
push edi
mov dword [esp + 0x10], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401d84
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00403159
push ebp
mov edi, eax
push esi
push edi
call fcn.00404e08
push 2
push 0x410cd0
push edi
call fcn.00404e95
add esp, 0x1c
test eax, eax
jne 0x401dfd
lea eax, [edi + 4]
push 0x5c
push eax
call fcn.00404ecc
add esp, 8
test eax, eax
je 0x401e97
add eax, 2
push 0x5c
push eax
call fcn.00404ecc
add esp, 8
test eax, eax
je 0x401e97
lea ecx, [eax + 2]
jmp 0x401e1b
push 2
lea ecx, [edi + 2]
push 0x410cd8
push ecx
call fcn.00404e95
add esp, 0xc
test eax, eax
jne 0x401e97
lea ecx, [edi + 6]
test ecx, ecx
je 0x401e97
cmp word [ecx], 0
je 0x401e97
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x5c
push ecx
call fcn.00404ecc
mov esi, eax
add esp, 8
test esi, esi
je 0x401e96
xor edx, edx
push edi
mov word [esi], dx
call ebx
cmp eax, 0xffffffff
jne 0x401e55
push 0
push edi
call ebp
push edi
call ebx
mov ecx, 0x5c
mov word [esi], cx
lea ecx, [esi + 2]
cmp eax, 0xffffffff
je 0x401e8e
test al, 0x10
je 0x401e8e
cmp word [ecx], 0
mov dword [esp + 0x14], 1
jne 0x401e32
pop ebx
push edi
call fcn.00404d23
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4
mov dword [esp + 0x14], 0
pop ebx
push edi
call fcn.00404d23
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4
Function at 0x402140
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
xor esi, esi
push edi
mov dword [esp + 0x28], esi
mov dword [ebp], esi
cmp dword [ebp + 8], esi
je 0x402320
push eax
mov edi, ebp
call fcn.00401ce0
cmp eax, 0xffffffff
je 0x402327
cmp eax, dword [ebp + 0xc]
jae 0x402327
mov ecx, dword [ebp + 8]
add ecx, eax
mov eax, dword [ecx]
lea edi, [eax + ecx]
xor eax, eax
add ecx, 4
xor ebx, ebx
xor edx, edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp ecx, edi
jae 0x402329
mov al, byte [ecx]
movzx eax, al
inc ecx
sub eax, 2
je 0x4021cc
sub eax, 0xfd
jne 0x4021dc
mov ebx, dword [ecx]
add ecx, 4
mov dword [esp + 0x14], ebx
mov edx, dword [ecx]
add ecx, 4
mov esi, ecx
mov dword [esp + 0x10], edx
add ecx, edx
jmp 0x4021dc
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x1c], eax
add ecx, 8
cmp ecx, edi
jb 0x4021a2
test esi, esi
je 0x402312
test edx, edx
je 0x402312
test ebx, ebx
je 0x402312
push ebx
call fcn.00403159
sub dword [esp + 0x14], 5
add esp, 4
push 5
push esi
lea ecx, [esp + 0x18]
push ecx
add esi, 5
push esi
lea edx, [esp + 0x24]
mov edi, eax
push edx
push edi
call fcn.00403260
test eax, eax
jne 0x402309
mov esi, dword [esp + 0x2c]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402230
sub eax, edx
sar eax, 1
cmp eax, 4
jb 0x402302
push esi
call fcn.00401d70
test eax, eax
je 0x402302
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022e4
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x30]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4022a6
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x2c]
jne 0x40229f
mov dword [esp + 0x28], 1
jmp 0x4022a6
mov dword [ebp], 5
cmp dword [esp + 0x1c], 0
jne 0x4022b4
cmp dword [esp + 0x18], 0
je 0x4022c6
lea eax, [esp + 0x18]
push eax
mov ecx, eax
push ecx
mov edx, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00404d23
mov eax, dword [esp + 0x2c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
push edi
mov dword [ebp], 4
call fcn.00404d23
mov eax, dword [esp + 0x2c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov dword [ebp], 7
push edi
call fcn.00404d23
add esp, 4
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov dword [ebp], 3
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x404bf2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x414060]
jne 0x404bfc
repz ret
jmp fcn.0040634c

Function at 0x40c91d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a73
and dword [ebp - 4], 0
cmp dword [0x415b08], 0
mov ebx, eax
jne 0x40c9ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ca7f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ca7f
push eax
call fcn.00406a01
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x415b08], eax
call esi
push eax
call fcn.00406a01
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x415b0c], eax
call esi
push eax
call fcn.00406a01
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x415b10], eax
call esi
push eax
call fcn.00406a01
pop ecx
mov dword [0x415b18], eax
test eax, eax
je 0x40c9ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a01
pop ecx
mov dword [0x415b14], eax
mov eax, dword [0x415b14]
cmp eax, ebx
je 0x40ca26
cmp dword [0x415b18], ebx
je 0x40ca26
push eax
call fcn.00406a7c
push dword [0x415b18]
mov esi, eax
call fcn.00406a7c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ca26
test edi, edi
je 0x40ca26
call esi
test eax, eax
je 0x40ca1d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ca1d
test byte [ebp - 0xc], 1
jne 0x40ca26
or dword [ebp + 0x10], 0x200000
jmp 0x40ca5f
mov eax, dword [0x415b0c]
cmp eax, ebx
je 0x40ca5f
push eax
call fcn.00406a7c
pop ecx
test eax, eax
je 0x40ca5f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ca5f
mov eax, dword [0x415b10]
cmp eax, ebx
je 0x40ca5f
push eax
call fcn.00406a7c
pop ecx
test eax, eax
je 0x40ca5f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x415b08]
call fcn.00406a7c
pop ecx
test eax, eax
je 0x40ca7f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ca81
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a82c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41a86e
call fcn.0041f45b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41a86e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41a865
xor eax, eax
jmp 0x41a876
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041a87c
pop edi
pop esi
pop ebx
ret 4

Function at 0x41fb2d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41fb5b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41fb79
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041fa93
jmp 0x41fb79
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41fb79
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041fa93
test edi, edi
mov eax, edi
jne 0x41fb63
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1002aaee
pop dword [ebp - 0x44]
mov eax, 0x703de93
add eax, 0x8fecc5b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa146baa2
add dword [ebp - 0x54], 0xad0b8aa9
mov dword [ebp - 0x50], 0x7b73b3de
sub dword [ebp - 0x50], 0x49406799
mov dword [ebp - 0x4c], 0xf78d8e7d
add dword [ebp - 0x4c], 0x54beb5b1
mov dword [ebp - 0x48], 0x6c0a4c27
sub dword [ebp - 0x48], 0x6c0a4c27
lea eax, [ebp - 0x54]
push eax
mov eax, 0x1915ae7c
sub eax, 0x912ee44
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb19b384f
sub dword [ebp - 0x54], 0x3d28cef9
mov dword [ebp - 0x50], 0xb106091
sub dword [ebp - 0x50], 0xc9a3ff1c
mov dword [ebp - 0x4c], 0x4bbf4956
add dword [ebp - 0x4c], 0x17b02316
mov dword [ebp - 0x48], 0xc0790fba
sub dword [ebp - 0x48], 0xc0790fba
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xaf8ccccf
sub eax, 0x9f8a0ca7
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37270
push 0
call eax
mov ecx, 0xd3e4ddfd
add ecx, 0x2c1b6cc0
xor ebx, ebx
add ebx, eax
mov esi, 0x10039600
add esi, dword [ebp - 0x44]
mov edi, 0xbeb47ca2
add edi, 0x837f3b72
xor dword [ebp - 0x30], 0xf095ccb7
mov edx, dword [esi]
sub dword [ebp - 0x3c], edx
add edx, edi
mov dword [ebx], edx
add ebx, 0xd1f68e33
add ebx, 0x2e0971d1
add esi, 0xc44fb5d1
sub esi, 0xc44fb5cd
loop 0x1002ac0c
add eax, 0x6ca8491c
add eax, 0x9358d4ab
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x6d2cd430
Capabilities:
Initialize iwebbrowser2

Disassembly:
sub esp, 0x20
push edi
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x6d2cd445
xor al, al
pop edi
add esp, 0x20
ret 0xc
push ebx
push ebp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x38]
push eax
push 0x6d2dc744
push 0x17
push 0
push 0x6d2dee00
mov dword [esp + 0x4c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebp, eax
test ebp, ebp
js 0x6d2cd514
push esi
mov esi, dword [esp + 0x34]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x64]
push edi
push esi
call edx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x2a4]
push 0
push edi
push esi
call ecx
lea edx, [esp + 0x10]
push edx
mov ebx, eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
push ebx
lea ecx, [esp + 0x24]
mov word [esp + 0x24], ax
call fcn.6d2d8ef8
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push edx
push edx
push edx
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2a8]
push ebx
push edi
push esi
mov ebp, eax
call edx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call ebx
test edi, edi
je 0x6d2cd513
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
push edi
push esi
call eax
pop esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x38]
test ebp, ebp
setns bl
test eax, eax
je 0x6d2cd52f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop ebp
mov al, bl
pop ebx
pop edi
add esp, 0x20
ret 0xc

Function at 0x6d2cddc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x6d2cddd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x6d2cde12
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x6d2cde0e
lea ebx, [ebx]
cmp esi, eax
jae 0x6d2cde12
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x6d2cde00
cmp esi, eax
jb 0x6d2cde18
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x6d2d53a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
lea eax, [esp + 4]
push eax
push 1
xor edi, edi
push edi
push 0x6d2ddf5c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d2d540f
push esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push str.ITCONFIG
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [esp + 0x10]
test esi, esi
pop esi
je 0x6d2d5411
mov eax, edi
mov ecx, dword [esp + 0x20c]
pop edi
xor ecx, esp
call fcn.6d2d932c
add esp, 0x20c
ret

Function at 0x6d2d5450
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
xor edi, edi
mov dword [esp + 4], 0x200
call fcn.6d2d53a0
test al, 0x10
jne 0x6d2d5481
call fcn.6d2d43f0
test eax, eax
jne 0x6d2d549c
mov eax, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x210
ret
lea eax, [esp + 0xc]
push eax
push 1
push edi
push 0x6d2ddf5c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d2d5521
mov eax, dword [esp + 0xc]
push esi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
push edi
push str.EnableAutoUpdateCheck
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
pop esi
jne 0x6d2d5521
mov dword [esp + 8], edi
call fcn.6d2d50f0
test eax, eax
je 0x6d2d5513
mov eax, dword [esp + 4]
push 4
lea edx, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.6d2d8ef8
mov eax, dword [esp + 0x18]
add esp, 0x10
jmp 0x6d2d5517
mov eax, dword [esp + 0x10]
cmp eax, 0x64
mov eax, 1
je 0x6d2d5523
mov eax, edi
mov ecx, dword [esp + 0x210]
pop edi
xor ecx, esp
call fcn.6d2d932c
add esp, 0x210
ret

Function at 0x6d2d5540
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 2
push 0
push 0x6d2ddf5c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d2d5576
mov ecx, dword [esp]
push str.EnableAutoUpdateCheck
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x6d2d5580
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x210], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x6d2ddf5c
push SysReAllocString
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], 0x64
mov dword [esp + 0x2c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x6d2d562a
call fcn.6d2d50f0
test eax, eax
je 0x6d2d55fb
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.6d2d8ef8
add esp, 0x10
jmp 0x6d2d5603
mov edx, dword [esp + 4]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 8]
mov edx, dword [esp]
push eax
lea ecx, [esp + 0x14]
push ecx
push 3
push 0
push str.EnableAutoUpdateCheck
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x214
ret

Function at 0x6d2d5810
Capabilities:
Get common file path
Parse url

Disassembly:
sub esp, 0x644
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x640], eax
push ebx
mov ebx, dword [esp + 0x650]
push esi
mov esi, dword [esp + 0x650]
push 0x3c
lea eax, [esp + 0xc]
push 0
push eax
mov byte [esp + 0x154], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0
lea ecx, [esp + 0x250]
push esi
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 0x400
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x6d2d58b8
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x48]
push ecx
push 0
lea edx, [esp + 0x254]
push 0
push edx
call dword [sym.imp.MSVCR100.dll__splitpath]
lea eax, [esp + 0x58]
push 0x6d2de3dc
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 0x1c
test eax, eax
je 0x6d2d5902
push edi
xor edi, edi
cmp byte [esi], 0
mov eax, esi
je 0x6d2d58ed
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
cmp cl, 0x20
je 0x6d2d58d4
cmp cl, 9
jne 0x6d2d58d9
push eax
call esi
jmp 0x6d2d58c8
movsx edx, byte [eax]
mov ecx, edi
shl ecx, 5
sub ecx, edi
add ecx, edx
inc eax
cmp byte [eax], 0
mov edi, ecx
jne 0x6d2d58c8
push edi
lea eax, [esp + 0x4c]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
pop edi
push ebx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
lea ecx, [esp + 0x44]
push ecx
push ebx
call esi
lea edx, [esp + 0x148]
push edx
push ebx
call esi
mov ecx, dword [esp + 0x648]
pop esi
pop ebx
xor ecx, esp
call fcn.6d2d932c
add esp, 0x644
ret