joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4757d6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00465571
and dword [ebp - 4], 0
cmp dword [0x49ef88], 0
mov ebx, eax
jne 0x475887
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x475938
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x48998c
push edi
call esi
test eax, eax
je 0x475938
push eax
call fcn.004654ff
mov dword [esp], 0x48997c
push edi
mov dword [0x49ef88], eax
call esi
push eax
call fcn.004654ff
mov dword [esp], 0x489968
push edi
mov dword [0x49ef8c], eax
call esi
push eax
call fcn.004654ff
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x49ef90], eax
call esi
push eax
call fcn.004654ff
pop ecx
mov dword [0x49ef98], eax
test eax, eax
je 0x475887
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004654ff
pop ecx
mov dword [0x49ef94], eax
mov eax, dword [0x49ef94]
cmp eax, ebx
je 0x4758df
cmp dword [0x49ef98], ebx
je 0x4758df
push eax
call fcn.0046557a
push dword [0x49ef98]
mov esi, eax
call fcn.0046557a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4758df
test edi, edi
je 0x4758df
call esi
test eax, eax
je 0x4758d6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4758d6
test byte [ebp - 0xc], 1
jne 0x4758df
or dword [ebp + 0x10], 0x200000
jmp 0x475918
mov eax, dword [0x49ef8c]
cmp eax, ebx
je 0x475918
push eax
call fcn.0046557a
pop ecx
test eax, eax
je 0x475918
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x475918
mov eax, dword [0x49ef90]
cmp eax, ebx
je 0x475918
push eax
call fcn.0046557a
pop ecx
test eax, eax
je 0x475918
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x49ef88]
call fcn.0046557a
pop ecx
test eax, eax
je 0x475938
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47593a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xe4088ee
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0x449
call fcn.0e43451f
cmp al, 0x11
jne 0xe408908
or dword [ebp - 4], 0xffffffff
jmp 0xe408918
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov eax, dword [eax*4 + 0xe465550]
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x485
call fcn.0e43451f
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0xe47c440]
movzx eax, al
lea esi, [edx + ecx*4]
mov dword [ebp + 0x10], eax
cmp ebx, 1
jne 0xe408972
test eax, eax
jbe 0xe4089b4
mov ebx, dword [ebp + 0x18]
shl ebx, 2
push edi
call fcn.0e43451f
movzx eax, al
mov ecx, eax
shl ecx, 8
or eax, ecx
mov ecx, eax
shl ecx, 0x10
or ecx, eax
and ecx, dword [ebp - 4]
inc edi
xor dword [esi], ecx
add esi, ebx
dec dword [ebp + 0x10]
jne 0xe40894c
jmp 0xe4089b4
mov ecx, dword [ebp + 0x18]
sub ecx, ebx
test eax, eax
jbe 0xe4089b4
mov eax, ecx
shl eax, 2
mov dword [ebp + 0x18], eax
push edi
call fcn.0e43451f
movzx ecx, al
mov eax, ecx
shl eax, 8
or ecx, eax
mov eax, ecx
shl eax, 0x10
or eax, ecx
and eax, dword [ebp - 4]
inc edi
mov ecx, ebx
test ebx, ebx
jbe 0xe4089ac
xor dword [esi], eax
add esi, 4
dec ecx
jne 0xe4089a4
add esi, dword [ebp + 0x18]
dec dword [ebp + 0x10]
jne 0xe408983
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0xe43a504
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push edi
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
sub eax, 3
je 0xe43a531
dec eax
dec eax
je 0xe43a52c
dec eax
dec eax
jne 0xe43a536
lea eax, [ebp - 0x60]
jmp 0xe43a539
lea eax, [ebp - 0x58]
jmp 0xe43a539
lea eax, [ebp - 0x50]
jmp 0xe43a539
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push eax
push 1
call fcn.0e43a35e
xor edi, edi
cmp eax, edi
jl 0xe43a614
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call dword [0xe3f156c]
test al, al
jne 0xe43a571
mov eax, 0x80070003
jmp 0xe43a614
mov eax, dword [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 4]
xor ecx, ecx
push esi
cmp cx, ax
je 0xe43a58b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0xe43a58e
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
push 0x4020
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
push 7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x100100
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [0xe3f14d0]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call dword [0xe3f1568]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [fcn.0e3f1530]
cmp esi, edi
jl 0xe43a610
push 4
push 0x28
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [0xe3f1510]
push dword [ebp + 8]
mov esi, eax
call dword [0xe3f145c]
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret 0xc
Function at 0xe43b0ce
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call dword [0xe3f156c]
test al, al
jne 0xe43b0fc
mov eax, 0x80070003
jmp 0xe43b1bf
mov eax, dword [ebp - 0x18]
push esi
xor ecx, ecx
push edi
mov edi, dword [ebp - 4]
cmp cx, ax
je 0xe43b116
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0xe43b119
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [0xe3f1578]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call dword [0xe3f1568]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [fcn.0e3f1530]
cmp esi, ebx
jge 0xe43b16f
mov eax, esi
jmp 0xe43b1bd
mov eax, dword [ebp + 8]
sub eax, 4
je 0xe43b189
dec eax
dec eax
je 0xe43b184
dec eax
dec eax
jne 0xe43b18e
lea eax, [ebp - 0x68]
jmp 0xe43b191
lea eax, [ebp - 0x60]
jmp 0xe43b191
lea eax, [ebp - 0x58]
jmp 0xe43b191
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0e43a667
neg eax
sbb eax, eax
and eax, 0x10
push eax
call fcn.0e43a35e
cmp eax, ebx
jge 0xe43b1bd
cmp eax, 0x8007000d
jne 0xe43b1bd
cmp dword [ebp + 8], 4
jne 0xe43b1bd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xe4466b0
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push edi
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [fcn.0e3f1548]
mov edi, eax
test edi, edi
jne 0xe4466ec
push 8
call dword [fcn.0e3f1090]
xor eax, eax
pop edi
pop esi
leave
ret 8
mov ax, word [esi]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
call dword [fcn.0e3f1354]
test eax, eax
jne 0xe446726
xor esi, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [fcn.0e3f1530]
mov eax, esi
jmp 0xe4466e6
push edi
lea eax, [ebp - 0x10]
push eax
call dword [fcn.0e3f1460]
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [fcn.0e3f149c]
movzx eax, word [ebp - 8]
mov dword [esi], eax
xor esi, esi
inc esi
jmp 0xe44670d

Function at 0xe4476e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ax, word [0xe4799f4]
mov word [ebp - 4], ax
jmp 0xe447768
movzx edx, word [ebp - 4]
mov eax, dword [0xe49e83c]
shr edx, 3
shl edx, 3
add eax, edx
cmp byte [eax + 5], 0
jne 0xe447713
cmp byte [eax + 7], 0x80
je 0xe447760
xor eax, eax
xor ecx, ecx
mov ax, word [ebp - 4]
or eax, 7
lsl ecx, eax
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xffff
jne 0xe447760
mov eax, dword [0xe49e83c]
add eax, edx
movzx ecx, byte [eax + 7]
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
movzx edx, word [eax + 2]
shl ecx, 0x10
or ecx, edx
cmp dword [ebp + 8], ecx
jne 0xe447760
movzx eax, byte [eax + 5]
movzx ecx, byte [ebp + 0xc]
xor eax, ecx
test eax, 0xfffffffe
je 0xe447777
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
cmp ax, word [0xe4799f0]
jb 0xe4476f6
xor eax, eax
leave
ret 8
mov eax, dword [ebp - 4]
or eax, 7
jmp 0xe447773
Function at 0x401430
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40638b
mov eax, dword fs:[0]
push eax
mov eax, 0x1038
call fcn.004062b0
mov eax, dword [0x409018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
push eax
push 0x407274
lea ecx, [ebp - 0x102c]
mov dword [ebp - 0x1018], 7
mov dword [ebp - 0x101c], 0
mov word [ebp - 0x102c], ax
call fcn.00401b80
xor eax, eax
push 0xffe
mov dword [ebp - 4], 0
push eax
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1014]
push esi
push 0x800
push eax
push 0x407274
push str.DS_Def
push 0x407338
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x1014], 0
jne 0x4014ea
xor ecx, ecx
jmp 0x401502
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4014f3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x102c]
call fcn.00401b80
push 6
push 0
push str.from
lea ecx, [ebp - 0x102c]
call fcn.004018e0
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov edi, eax
cmp edi, 0xffffffff
je 0x40158b
push 1
lea ecx, [edi + 1]
push ecx
push 0x407360
lea ecx, [ebp - 0x102c]
call fcn.004018e0
cmp eax, 0xffffffff
je 0x40158b
sub eax, edi
sub eax, 6
push eax
lea eax, [edi + 6]
push eax
lea eax, [ebp - 0x1044]
push eax
lea ecx, [ebp - 0x102c]
call fcn.00401780
push eax
mov ecx, ebx
call fcn.004016d0
cmp dword [ebp - 0x1030], 8
jb 0x401599
push dword [ebp - 0x1044]
call esi
add esp, 4
jmp 0x401599
push 0xf
push 0x407364
mov ecx, ebx
call fcn.00401b80
cmp dword [ebp - 0x1018], 8
jb 0x4015ad
push dword [ebp - 0x102c]
call esi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004058f7
mov esp, ebp
pop ebp
ret 4

Function at 0x402470
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push 0x407430
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x4024d3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.e_GetBrowserCurrentHpUrl
push eax
call esi
push str.e_GetBrowserCurrentDsUrl
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.e_GetDefaultConfigDir
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.e_HasInstalledBrowser
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.e_SetHomePage
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.e_SetDefaultSearch
push dword [edi]
mov dword [edi + 0xc], eax
call esi
mov dword [edi + 0x10], eax
pop esi
pop edi
ret
Function at 0x403160
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x409018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x30
lea eax, [ebx + 4]
push 0
push eax
mov esi, ecx
mov dword [ebp - 0xc], 0
mov dword [ebx], 0
call sub.MSVCR110.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
mov dword [ebp - 8], 0x34
jb 0x4031a5
mov eax, dword [esi]
jmp 0x4031a7
mov eax, esi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40321c
push edi
push eax
call fcn.004058ee
add esp, 4
cmp dword [esi + 0x14], 8
mov edi, eax
mov dword [ebp - 0x14], edi
jb 0x4031ce
mov esi, dword [esi]
push edi
push dword [ebp - 0x10]
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x403211
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40751c
push edi
mov dword [ebp - 8], 0x34
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x403211
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x403211
mov ecx, 0xd
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004058f7
mov esp, ebp
pop ebp
ret

Function at 0x403360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x409018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push str.IsWow64Process
xor esi, esi
push str.kernel32
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0x208
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 8], esi
test edi, edi
je 0x4033ca
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x4033ca
cmp dword [ebp - 8], esi
je 0x4033ca
lea eax, [ebp - 0x14]
push eax
push 0x20119
jmp 0x4033d3
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftCryptography
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40340c
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 1
test eax, eax
cmove esi, ecx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40341a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004058f7
mov esp, ebp
pop ebp
ret
Function at 0x403e10
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x409018]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push str.GlobalGUID_1F4C6304_865F_41EA_B18C_DB10B5F77DF5_
push 1
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0xc], eax
test eax, eax
je 0x403ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403ea0
mov esi, 1
jmp 0x403ee2
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x403f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 8], eax
test eax, eax
je 0x403ee0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
test eax, eax
je 0x403ee0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 4], 0
xor esi, esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403ef9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403f08
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004058f7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x409018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x69], 0
mov edi, 6
jmp 0x405030
push str.urlmon.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4050a4
push ebx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push str.URLDownloadToFileW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40509d
push 0
push 0
push dword [ebp - 0x70]
push ebx
push 0
call eax
mov ebx, eax
test ebx, ebx
jns 0x4050d1
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call sub.MSVCR110.dll_memset
push ebx
push str.URLDownloadToFileW_ret:0X_08X_n
lea eax, [ebp - 0x68]
push 0x64
push eax
call dword [sym.imp.MSVCR110.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [ebp - 0x74]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
dec edi
test eax, eax
jne 0x405030
movzx eax, byte [ebp - 0x69]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004058f7
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
pop edi
mov al, 1
pop esi
xor ecx, ebp
movzx eax, al
pop ebx
call fcn.004058f7
mov esp, ebp
pop ebp
ret 8
Function at 0xe0f370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xe0f38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xe38074
push ecx
mov edi, eax
call fcn.00e23198
mov esi, eax
add esp, 8
test esi, esi
jne 0xe0f3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00e2302e
push esi
call fcn.00e22fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xe12850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xe128ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xe3d720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe128ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00e231e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xe128ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xe3d720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe1292a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00e24082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xe12957
mov word [eax], si
add eax, 2
push eax
call fcn.00e24030
add esp, 4
jmp 0xe12959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xe128ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xe128b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xe12ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xe13080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xe130c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xe38458
push ecx
call fcn.00e231e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00e231e1
add esp, 0x10
jmp 0xe130d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00e2320b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00e22dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00e13050
mov eax, dword [0xe3d728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xe1313b
push esi
call fcn.00e12fb0
add esp, 4
mov dword [0xe3d728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xe1314c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00e12ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xe16440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xe164b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xe1648e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xe16471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xe1647e
add edx, ecx
cmp ebx, edx
jb 0xe1648a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xe16467
xor ecx, ecx
jmp 0xe164a2
test eax, eax
jne 0xe16492
xor ecx, ecx
jmp 0xe164a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00e163c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xe168f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xe16921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xe16946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xe1696e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xe16993
push ecx
push esi
call fcn.00e164c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret