joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7023ff10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x468
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push edi
push 0x208
xor edi, edi
lea eax, [esp + 0xc]
push edi
push eax
mov ebx, ecx
call fcn.702e95e0
add esp, 0xc
push str.wdres.dll
push 0x70359d48
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x70240046
mov ecx, esi
call fcn.70289f00
test eax, eax
je 0x70240046
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov dword [esi + 0x138c], eax
mov eax, dword [esi + 0xa4]
push esi
push eax
call fcn.70286050
cmp eax, 1
jne 0x7023fff0
push 0x258
lea ecx, [esp + 0x214]
push edi
push ecx
mov dword [esi + 0x138c], edi
call fcn.702e95e0
lea edx, [esp + 0x14]
push edx
push str.res:___s_nav.htm
mov ecx, 0x12c
lea ebx, [esp + 0x224]
call fcn.7020db00
add esp, 0x14
push edi
push esi
mov ecx, ebx
call fcn.7023d290
lea eax, [edi + 1]
pop edi
pop ebx
mov ecx, dword [esp + 0x464]
xor ecx, esp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x70240040
lea edi, [esi + 0xa0]
mov eax, ebx
call fcn.70208e30
mov eax, dword [esi + 0xa4]
push 0xf
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0xa4]
push 0
push 0x384
push 0xf
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
pop edi
pop ebx
mov ecx, dword [esp + 0x464]
xor ecx, esp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x138c], edi
mov ecx, dword [esp + 0x46c]
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret

Function at 0x702439f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov eax, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
test byte [0x7036f0a4], al
jne 0x70243a1c
or dword [0x7036f0a4], eax
call edi
mov dword [0x7036f0a0], eax
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
test al, al
je 0x70243a76
mov ebx, dword [ebp + 8]
push esi
mov ecx, ebx
call fcn.70244270
test eax, eax
je 0x70243a76
cmp dword [esi + 8], 0
je 0x70243a4e
call edi
sub eax, dword [0x7036f0a0]
cmp eax, 0x493e0
jb 0x70243a5f
mov ecx, esi
call fcn.70243100
mov dword [esi + 8], eax
call edi
mov dword [0x7036f0a0], eax
cmp dword [esi + 8], 0
je 0x70243aa5
push esi
call fcn.702437d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 8], 0
je 0x70243aa5
cmp dword [esi + 0x24], 0x10
mov ecx, dword [esi + 0x20]
jb 0x70243a8a
mov eax, dword [esi + 0x10]
jmp 0x70243a8d
lea eax, [esi + 0x10]
push 0
inc ecx
push ecx
push eax
push 0x10000001
call fcn.7030a182
neg eax
sbb eax, eax
neg eax
mov dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x70248e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x7030f228
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
cmp dword [ebx + 8], edi
jne 0x7024902d
mov al, byte [ebx + 0x17]
cmp al, 1
jne 0x70248eb0
mov eax, dword [ebx + 4]
cmp eax, 0xffff
jae 0x70248e98
mov ecx, dword [0x70358070]
push 0x2000
push edi
push edi
movzx eax, ax
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebx + 8], eax
jmp 0x70248fc9
push 0x2010
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebx + 8], eax
jmp 0x70248fc9
mov ecx, dword [ebx + 4]
cmp ecx, 0xffff
jae 0x70248f32
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x40], edi
cmp al, 2
jne 0x70248fc9
push ecx
mov eax, esp
movzx edx, cx
mov dword [esp + 0x14], esp
push ecx
mov dword [eax], edx
mov eax, esp
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov dword [eax], 0x7032b7cc
call fcn.70248a20
mov esi, dword [esp + 0x14]
test al, al
je 0x70248f1e
mov eax, dword [esp + 0x18]
mov ecx, dword [0x70358070]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
call fcn.70248d70
mov dword [ebx + 8], eax
xor edi, edi
cmp esi, edi
je 0x70248fc9
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x70248fc9
push 0x7032b798
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], edi
call fcn.702e4f84
add esp, 0xc
test eax, eax
jne 0x70248fc9
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x70248fc9
push 2
push edi
push eax
call fcn.702e4c2e
mov eax, dword [esp + 0x1c]
add esp, 0xc
push eax
call fcn.702e4e50
mov ecx, dword [esp + 0x14]
add esp, 4
push 0
push 0
push ecx
mov edi, eax
call fcn.702e4c2e
add esp, 0xc
push edi
call fcn.702df932
mov esi, eax
add esp, 4
test esi, esi
je 0x70248fba
mov edx, dword [esp + 0x10]
push edx
push edi
push 1
push esi
call fcn.702e4b87
add esp, 0x10
cmp byte [ebx + 0x17], 2
jne 0x70248fb1
mov edi, esi
call fcn.70248d70
mov dword [ebx + 8], eax
push esi
call fcn.702e1ea6
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call fcn.702e486b
add esp, 4
xor edi, edi
mov eax, dword [ebx + 8]
cmp eax, edi
jne 0x70248ff1
xor ecx, ecx
mov word [ebx + 0x14], cx
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov byte [ebx + 0x16], cl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x1c]
push edx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
movzx eax, word [ebx + 0x14]
cmp ax, di
je 0x70249017
movzx ecx, ax
mov eax, dword [esp + 0x20]
cdq
idiv ecx
mov dword [ebx + 0xc], eax
jmp 0x7024901a
mov dword [ebx + 0xc], edi
cmp word [esp + 0x2e], 0x20
mov edx, dword [esp + 0x24]
sete al
mov dword [ebx + 0x10], edx
mov byte [ebx + 0x16], al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7024a470
Capabilities:
Read file via mapping

Disassembly:
push 0
push 1
push 0x7036ee2c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x7024a4c4
push esi
push str.safe3601407101114
push 0x1000
push eax
push 4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x7024a4bd
call fcn.7029a540
push 0x1000
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x703594f4], eax
pop esi
ret
mov eax, dword [0x703594f4]
pop esi
ret
mov eax, dword [0x703594f4]
ret

Function at 0x7024baf0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x7024bafc
ret
push ebp
push esi
xor ecx, ecx
mov esi, 0x400
mov eax, esi
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.702df932
mov edi, eax
add esp, 4
test edi, edi
je 0x7024bb97
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x7024bb30
push ebx
push esi
push edi
push 0x7032ae50
call ebp
lea ecx, [esi - 2]
cmp eax, ecx
jb 0x7024bb8a
push edi
call fcn.702e1ea6
add esp, 4
cmp esi, 0x7fff
jae 0x7024bb84
add esi, esi
cmp esi, 0x7fff
jbe 0x7024bb61
mov esi, 0x7fff
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.702df932
mov edi, eax
add esp, 4
test edi, edi
jne 0x7024bb30
jmp 0x7024bb97
pop edi
pop esi
xor eax, eax
pop ebp
ret
xor ecx, ecx
xor edx, edx
mov word [edi + eax*2], cx
mov word [edi + eax*2 + 2], dx
mov eax, edi
call fcn.7024ba90
push edi
mov esi, eax
call fcn.702e1ea6
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x7024c7b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esi + 8]
push ebx
lea ebx, [esi + 8]
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x7024c7dc
pop ebx
add esp, 0x10
ret
cmp eax, 2
jne 0x7024c7e8
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edx, dword [esi + 4]
test edx, edx
je 0x7024c7e1
push edi
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x7024c790
push 0
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x7024c860
mov ecx, dword [esi + 4]
push 0x64
push 0
lea edx, [esp + 0x18]
push edx
push 2
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
xor edi, edi
test eax, eax
je 0x7024c845
mov edi, 1
mov ecx, edi
neg ecx
sbb ecx, ecx
push 0
add ecx, 2
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov eax, edi
pop edi
pop ebx
add esp, 0x10
ret
push 0
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
pop edi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x7024d2e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7031029b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 4], esi
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 8], eax
lea ecx, [esi + 0xc]
xor edx, edx
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edx
lea eax, [esp + 0x40]
mov word [ecx + 4], dx
call fcn.7020f220
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 2
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
mov word [ecx + 4], ax
push eax
lea eax, [esp + 0x20]
call fcn.7020f220
cmp dword [esp + 0x30], 8
jb 0x7024d384
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.702e1c24
add esp, 4
xor edx, edx
cmp dword [esp + 0x50], 8
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], dx
jb 0x7024d3af
mov eax, dword [esp + 0x3c]
push eax
call fcn.702e1c24
add esp, 4
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret 0x3c
Function at 0x702577f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
call fcn.702237c0
mov eax, dword [0x703548b0]
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x70257822
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x70257822
test esi, esi
je 0x70257822
mov dword [esi], 0
mov eax, 0x80004005
pop esi
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
push eax
push ecx
call fcn.70259ad0
pop esi
ret 0xc

Function at 0x70257840
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
call fcn.702237c0
call fcn.70218440
test eax, eax
jne 0x7025796f
cmp dword [0x703593cc], eax
jne 0x70257879
call fcn.70215a50
test eax, eax
je 0x7025788d
mov eax, dword [0x7035903c]
cmp eax, 0xa
ja 0x7025796f
je 0x7025796f
call fcn.70259940
mov edi, eax
test edi, edi
jl 0x70257956
call fcn.70214b50
test eax, eax
je 0x702578b7
call fcn.7020e640
call fcn.7021bf10
test eax, eax
je 0x70257956
mov ecx, dword [0x7035806c]
push 0x104
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x702578d5
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.CLSIDB69F34DD_F0F9_42DC_9EDD_957187DA688DInprocServer32
push SysReAllocStringLen
call esi
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push str.NoExplorer
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB69F34DD_F0F9_42DC_9EDD_957187DA688D
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
call esi
mov edx, dword [0x7032d384]
mov ecx, dword [0x7032d388]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [0x7032d38c]
mov dword [eax + 4], ecx
mov ecx, dword [0x7032d390]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.702576a0
add esp, 0x10
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x210
ret

Function at 0x70257990
Capabilities:
Delete registry key

Disassembly:
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB69F34DD_F0F9_42DC_9EDD_957187DA688D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [0x7032d384]
mov edx, dword [0x7032d388]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x7032d38c]
mov dword [eax + 4], edx
mov edx, dword [0x7032d390]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.70257740
add esp, 0x10
jmp fcn.70259400
Function at 0x702579e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x38]
push edx
push str.SiteAccess
push str.SOFTWARE360Safe_safemon
mov edi, 4
or ebp, 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebp
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], edi
call esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x40]
push edx
push str.MonitoringSpoofing
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebp
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], edi
call esi
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x48]
push edx
push str.MonitoringMalware
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], edi
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea ebp, [edi - 3]
cmp ebx, 0xffffffff
jne 0x70257a96
mov ebx, ebp
cmp ecx, 0xffffffff
je 0x70257a96
mov ebx, ecx
cmp eax, 0xffffffff
jne 0x70257aa3
cmp ecx, eax
mov eax, ebp
je 0x70257aa3
mov eax, ecx
mov dword [0x7037100c], eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x50]
push edx
push str.IEProtNotify
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x70371008], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], edi
call esi
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x24]
push edx
mov dword [0x70371028], eax
lea eax, [esp + 0x58]
push eax
push str.SubmitRiskInfo
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], edi
call esi
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x28]
push eax
mov dword [0x7037102c], ecx
lea ecx, [esp + 0x60]
push ecx
push str.ProcDownload
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], edi
call esi
xor edx, edx
cmp dword [esp + 0x24], ebp
lea eax, [esp + 0x5c]
sete dl
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], edi
mov dword [0x70371014], edx
lea edx, [esp + 0x68]
push edx
push str.ProcIM
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call esi
xor eax, eax
cmp dword [esp + 0x28], ebp
pop edi
sete al
pop esi
pop ebp
pop ebx
mov dword [0x70371018], eax
add esp, 0x54
ret
Function at 0x70259bd0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push edi
push 0
lea edi, [esi + 4]
push 1
push edi
mov dword [esp + 0x18], edi
call ebx
test eax, eax
je 0x70259c09
mov eax, dword [edi]
cmp eax, 1
jne 0x70259d80
push ebp
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x22]
push edx
mov word [esp + 0x24], cx
call fcn.702e95e0
add esp, 0xc
push str...ipc_safevideo.exe
push 0x70359d48
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x18]
push ecx
call edi
test eax, eax
je 0x70259c71
push 0
push 1
lea ebp, [esi + 8]
push ebp
call ebx
test eax, eax
jne 0x70259c71
lea edi, [esi + 0x10]
lea edx, [esp + 0x18]
call fcn.7020b380
push 1
push 2
push ebp
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [0x70359fe0], 0
je 0x70259c91
push 0x104
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x70259d53
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x70326328
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x70259cef
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x70259cef
push str.IEXPLORE.EXE
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x70259d53
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x2a
lea edx, [esp + 0x20]
push edx
push 0
call ebp
test eax, eax
je 0x70259d24
push str.Internet_ExplorerIEXPLORE.EXE
lea eax, [esp + 0x1c]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x18]
push edx
call edi
test eax, eax
jne 0x70259d53
push 0
push 0x26
lea eax, [esp + 0x20]
push eax
push 0
call ebp
test eax, eax
je 0x70259d74
push str.Internet_ExplorerIEXPLORE.EXE
lea ecx, [esp + 0x1c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x70259d74
push 0
push 1
lea ebp, [esi + 0xc]
push ebp
call ebx
test eax, eax
jne 0x70259d74
lea edi, [esi + 0x14]
lea edx, [esp + 0x18]
call fcn.7020b380
push 1
push 2
push ebp
call ebx
mov ecx, dword [esp + 0x10]
push 1
push 2
push ecx
call ebx
pop ebp
mov ecx, dword [esp + 0x21c]
pop edi
pop ebx
xor ecx, esp
call fcn.702e1c2f
add esp, 0x218
ret
Function at 0x7025a430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7030f983
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.7025b320
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
lea eax, [esi + 0x38]
push eax
mov byte [esp + 0x18], 1
call fcn.70244ad0
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x7025b760
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x703127c1
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x27c]
mov dword fs:[0], eax
xor eax, eax
mov edi, ecx
mov dword [esp + 0x14], vtable.MsgTransport::CClient.0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0xffffffff
mov byte [esp + 0x2c], al
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], eax
push 0x208
push eax
mov dword [esp + 0x28c], eax
lea eax, [esp + 0x74]
push eax
call fcn.702e95e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.pipe_client__d__d
mov eax, 0x208
lea ebx, [esp + 0x78]
call fcn.7021b490
xor ebx, ebx
add esp, 0xc
mov ebp, 7
xor ecx, ecx
lea eax, [esp + 0x6c]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x7025b822
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x70]
lea esi, [esp + 0x38]
call fcn.7020f4d0
mov byte [esp + 0x284], 1
xor edx, edx
push 0x1a
mov eax, str.window_device_360Tray_port
lea esi, [esp + 0x54]
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], dx
call fcn.7020f4d0
push 0x3e8
push ebx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x294], 2
call fcn.702619a0
mov esi, 8
cmp dword [esp + 0x68], esi
jb 0x7025b89d
mov edx, dword [esp + 0x54]
push edx
call fcn.702e1c24
add esp, 4
xor eax, eax
mov byte [esp + 0x284], bl
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], ax
cmp dword [esp + 0x4c], esi
jb 0x7025b8c6
mov ecx, dword [esp + 0x38]
push ecx
call fcn.702e1c24
add esp, 4
mov eax, dword [edi + 0x14]
xor edx, edx
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], dx
jb 0x7025b8e3
mov edi, dword [edi + 4]
jmp 0x7025b8e6
add edi, 4
mov ecx, dword [esp + 0x28c]
push ebx
push 1
push ecx
push eax
push edi
lea ecx, [esp + 0x28]
call fcn.70261a40
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x7025b929
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov esi, dword [esp + 0x18]
mov edi, esi
cmp esi, ebx
je 0x7025b923
call fcn.70261910
push edi
call fcn.702e1c24
add esp, 4
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x284], 0xffffffff
mov dword [esp + 0x14], vtable.MsgTransport::CClient.0
cmp ecx, ebx
je 0x7025b95f
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
mov esi, dword [esp + 0x18]
mov edi, esi
cmp esi, ebx
je 0x7025b95f
call fcn.70261910
push edi
call fcn.702e1c24
add esp, 4
mov ecx, dword [esp + 0x27c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x274
ret 4
Function at 0x7025c670
Capabilities:
Create thread

Disassembly:
push esi
push edi
lea edi, [ebx + 1]
push edi
call fcn.702df932
mov esi, eax
add esp, 4
test esi, esi
je 0x7025c6d3
push edi
push 0
push esi
call fcn.702e95e0
mov eax, dword [esp + 0x18]
push ebx
push eax
push esi
call fcn.702e46d0
add esp, 0x18
push 0
push 0
push esi
push 0x7025c510
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x7025c6ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret
push esi
call fcn.702e1ea6
add esp, 4
pop edi
mov eax, 1
pop esi
ret
Function at 0x7025f450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, 0x70353194
mov ebx, 3
lea ecx, [ecx]
lea ecx, [esi - 0x20]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7025f468
sub eax, edi
mov edx, eax
lea eax, [esi - 0x20]
test eax, eax
je 0x7025f489
xor eax, eax
test edx, edx
jbe 0x7025f489
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x7025f480
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7025f490
sub eax, edx
mov ecx, eax
test esi, esi
je 0x7025f4ae
xor eax, eax
test ecx, ecx
jbe 0x7025f4ae
xor byte [esi + eax], 6
inc eax
cmp eax, ecx
jb 0x7025f4a5
lea ecx, [esi + 0x20]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7025f4b6
sub eax, edi
mov edx, eax
test ecx, ecx
je 0x7025f4d9
xor eax, eax
test edx, edx
jbe 0x7025f4d9
jmp 0x7025f4d0
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x7025f4d0
add esi, 0x6c
sub ebx, 1
jne 0x7025f460
pop edi
pop esi
pop ebx
ret