joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7039c650
Capabilities:
Create http request

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [0x703f2008]
mov eax, dword [esp + 0x40]
test ebx, ebx
je 0x7039c670
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
test eax, eax
je 0x7039c663
mov edx, dword [eax]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], 0xa
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 0x14
test eax, eax
jne 0x7039c748
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x7039c748
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], 0x10000000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
test eax, eax
cmove eax, ebx
mov dword [esp], eax
call dword [sym.imp.wininet.dll_InternetOpenW]
sub esp, 0x14
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
sub esp, 4
test esi, esi
je 0x7039c770
mov dword [esp], esi
mov dword [esp + 4], 0x7039d190
call dword [sym.imp.wininet.dll_InternetSetStatusCallbackW]
xor eax, eax
sub esp, 8
lock cmpxchg dword [0x703f2008], esi
jne 0x7039c758
mov ebx, dword [0x703f2008]
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
call fcn.703a4dd0
mov ebx, eax
jmp 0x7039c6c3
mov dword [esp], esi
call dword [sym.imp.wininet.dll_InternetCloseHandle]
sub esp, 4
jmp 0x7039c737
test byte [0x703d83a0], 4
je 0x7039c737
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.InternetOpen_failed:__ld_n
mov dword [esp + 8], str.create_internet_session
mov dword [esp + 4], 0x703d83a0
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.7039c480
jmp 0x7039c737
Function at 0x7039ce10
Capabilities:
Query remote server for available data

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
or dword [ebx + 0x6c], 0x80
mov eax, ebx
call fcn.7039cd00
test eax, eax
js 0x7039ce87
lea eax, [ebx + 0x80]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x64]
mov dword [esp], eax
call dword [sym.imp.wininet.dll_InternetQueryDataAvailable]
sub esp, 0x10
test eax, eax
je 0x7039ce90
mov edx, dword [ebx + 0x80]
mov dword [ebx + 0x7c], edx
mov eax, dword [ebx + 8]
or dword [ebx + 0x6c], 0x14
mov ebx, dword [ebx + 0x78]
mov ecx, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [ecx + 0x14]
xor eax, eax
sub esp, 0x10
add esp, 0x28
pop ebx
ret
test byte [0x703d83a0], 4
jne 0x7039cea0
mov edx, dword [ebx + 0x7c]
jmp 0x7039ce60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.InternetQueryDataAvailable_failed:__lu_n
mov dword [esp + 8], str.protocol_syncbinding
mov dword [esp + 4], 0x703d83a0
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.7039c480
jmp 0x7039ce99
Function at 0x7039e5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x4c
mov ebp, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edi, dword [esp + 0x60]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 4
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
lea edi, [esp + 0x38]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0x18
test eax, eax
je 0x7039e664
mov ebx, eax
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x7039e670
test ebx, ebx
je 0x7039e664
test byte [0x703d83b0], 8
jne 0x7039e6b0
mov eax, dword [esp + 0x60]
mov dword [eax], 0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x3c], 4
mov dword [esp + 0x38], 4
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0x18
mov ebx, eax
jmp 0x7039e64d
mov eax, esi
call fcn.7039d9b0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s_failed:__ld_n
mov dword [esp + 8], str.get_dword_from_reg
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 3
call fcn.7039dc50
jmp 0x7039e65a

Function at 0x7039e6f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x4c
mov ebp, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edi, dword [esp + 0x64]
mov dword [esp + 0x2c], edx
lea ecx, [esp + 0x3c]
mov ebx, dword [esp + 0x60]
lea edx, [esp + 0x38]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x38], 1
mov dword [esp + 0xc], edx
add edi, edi
mov dword [esp + 8], 0
mov dword [esp + 0x3c], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0x18
test eax, eax
je 0x7039e765
mov ebx, eax
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x7039e770
test ebx, ebx
je 0x7039e765
test byte [0x703d83b0], 8
jne 0x7039e7b0
mov eax, dword [esp + 0x60]
xor edx, edx
mov word [eax], dx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], edi
mov edi, dword [esp + 0x60]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x38]
mov dword [esp + 0x38], 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0x18
mov ebx, eax
jmp 0x7039e74f
mov eax, esi
call fcn.7039d9b0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s_failed:__ld_n
mov dword [esp + 8], str.get_string_from_reg
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 3
call fcn.7039dc50
jmp 0x7039e75c
Function at 0x7039f120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x5c
cmp edx, 0x1203
je 0x7039f168
mov ebx, edx
cmp edx, 0x1401
je 0x7039f168
cmp dword [esp + 0x74], 1
mov edi, eax
je 0x7039f1f0
test dword [esp + 0x74], 0xfffffffd
je 0x7039f1b0
test byte [0x703d83b0], 4
jne 0x7039f180
mov esi, 0x80004005
jmp 0x7039f171
mov dword [ebp], 3
xor esi, esi
add esp, 0x5c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], str.Unknown_URLZONEREG:__d_n
mov dword [esp + 8], str.get_action_policy
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.7039dc50
jmp 0x7039f15b
lea ecx, [esp + 0x28]
mov edx, eax
mov eax, ParseURLW
call fcn.7039f090
test eax, eax
mov esi, eax
jns 0x7039f20a
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x7039f171
mov eax, dword [esp + 0x70]
mov dword [esp + 4], 1
mov ecx, ebp
mov edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.7039f120
mov esi, eax
jmp 0x7039f171
lea ecx, [esp + 0x28]
mov edx, eax
mov eax, reloc.shlwapi.dll_ParseURLW
call fcn.7039f090
test eax, eax
mov esi, eax
js 0x7039f171
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x30]
mov dword [esp + 8], ebx
mov dword [esp], edx
mov dword [esp + 4], 0x703e03fa
mov dword [esp + 0x2c], eax
call dword [sym.imp.user32.dll_wsprintfW]
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
cmp eax, 0xea
je 0x7039f2b0
cmp eax, 2
je 0x7039f2c0
test eax, eax
je 0x7039f298
test byte [0x703d83b0], 2
jne 0x7039f2c7
mov esi, 0x8000ffff
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x7039f1c6
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x7039f171
mov esi, 0x80070057
jmp 0x7039f27d
mov esi, 0x80004005
jmp 0x7039f27d
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RegQueryValue_failed:__ld_n
mov dword [esp + 8], str.get_action_policy
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 1
call fcn.7039dc50
jmp 0x7039f278
Function at 0x7039fc20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x4c
mov ebp, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], edx
lea edi, [esp + 0x3c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x38], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call ebp
sub esp, 0x18
test eax, eax
lea ecx, [esp + 0x38]
jne 0x7039fc7d
cmp dword [esp + 0x3c], 4
je 0x7039fcb4
test byte [0x703d83b0], 4
jne 0x7039fce0
mov dword [esp + 0x38], 4
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x703e0618
mov dword [esp], ebx
call ebp
sub esp, 0x18
test eax, eax
jne 0x7039fcd1
cmp dword [esp + 0x3c], 4
jne 0x7039fcc8
add esp, 0x4c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x703d83b0], 4
jne 0x7039fd28
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x2c]
call fcn.7039d9b0
mov dword [esp + 0xc], str.Unexpected_value_type__ld_for_value__s__expected_REG_DWORD_n
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0x703e125c
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.7039dc50
lea ecx, [esp + 0x38]
jmp 0x7039fc7d
mov eax, 0x703e0618
call fcn.7039d9b0
mov dword [esp + 0xc], str.Unexpected_value_type__ld_for_value__s__expected_REG_DWORD_n
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0x703e125c
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.7039dc50
xor eax, eax
jmp 0x7039fcd3
Function at 0x703a2c9a
Capabilities:
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
test byte [0x703d83b0], 8
jne 0x703a2cc8
mov ecx, dword [0x703f2010]
test ecx, ecx
je 0x703a2cf6
mov ecx, dword [ebp - 4]
mov eax, dword [0x703f200c]
leave
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x703e0b07
mov dword [esp + 8], str.IsInternetESCEnabledLocal
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 3
call fcn.7039dc50
mov ecx, dword [0x703f2010]
test ecx, ecx
jne 0x703a2cb4
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMap
mov dword [esp], ParseURLW
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x703a2d40
mov dword [0x703f2010], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x703f200c]
leave
lea esp, [ecx - 4]
ret
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.IEHarden
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x703a2d8a
cmp dword [ebp - 0x18], 4
je 0x703a2da0
mov dword [0x703f200c], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x703a2d29
mov edx, dword [ebp - 0x10]
xor eax, eax
test edx, edx
setne al
jmp 0x703a2d85

Function at 0x703a2db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x38
lea edx, [esp + 0x2c]
mov dword [esp + 0x24], 4
mov dword [esp + 8], edx
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x703a2de8
add esp, 0x38
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x24]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.UrlEncoding
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
sub esp, 4
test ebx, ebx
sete al
add esp, 0x38
pop ebx
ret
Function at 0x703a7f40
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x98
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x60], ebx
mov edx, dword [ecx + 0x14]
mov ebx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x1c]
test byte [0x703d8470], 1
jne 0x703a7fe0
mov eax, ebx
and eax, 0xfffffffd
jne 0x703a8060
lea edx, [ebp - 0x50]
mov ecx, 0xd
lea ebx, [ebp - 0x58]
mov edi, edx
mov edx, 0x8400
rep stosd dword es:[edi], eax
mov eax, 0x3c
mov dword [ebp - 0x4c], str.open
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x48], esi
mov dword [esp], ebx
call dword [sym.imp.shell32.dll_ShellExecuteExW]
sub esp, 4
test eax, eax
je 0x703a8060
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x20
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], edx
call fcn.703a57a0
mov dword [ebp - 0x64], eax
mov eax, edi
call fcn.703a57a0
mov edi, eax
mov eax, esi
call fcn.703a57a0
mov ecx, dword [ebp - 0x6c]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ecx
mov edx, dword [ebp - 0x68]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x60]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x5c]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x64]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s__s__s__p__p__p__lu__lu_partial_stub_n
mov dword [esp + 0x18], edx
mov dword [esp + 8], str.HlinkSimpleNavigateToString
mov dword [esp + 4], 0x703d8470
mov dword [esp], 0
call fcn.703a5c50
jmp 0x703a7f7d
mov eax, 0x80004001
jmp 0x703a7fce
Function at 0x703adf20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
mov ebp, dword [edx + 0x24]
mov edx, dword [eax]
cmp word [edx], 0x23
je 0x703adf88
test byte [0x703d8490], 8
je 0x703ae005
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x703e2a70
mov dword [esp + 8], str.parse_fragment
mov dword [esp + 4], 0x703d8490
mov dword [esp], 3
call fcn.703a9840
mov eax, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ecx, word [edx + 2]
lea eax, [edx + 2]
mov dword [esi + 0x74], edx
mov dword [ebx], eax
test cx, cx
je 0x703adff0
test ebp, ebp
mov ebp, edi
setne dl
and ebp, 0x80
jmp 0x703adfbd
add eax, 2
mov dword [ebx], eax
movzx ecx, word [eax]
test cx, cx
je 0x703adff0
cmp cx, 0x25
jne 0x703adfb0
test dl, dl
je 0x703adfb0
test ebp, ebp
jne 0x703adfb0
mov eax, ebx
mov byte [esp + 0x3c], dl
call fcn.703aaf10
test eax, eax
jne 0x703ae010
mov edx, dword [esi + 0x74]
mov dword [ebx], edx
mov dword [esi + 0x74], 0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esi + 0x74]
sub eax, ebp
sar eax, 1
mov edx, eax
mov dword [esi + 0x78], eax
test byte [0x703d8490], 8
jne 0x703ae020
mov eax, 1
jmp 0x703adf7a
mov eax, dword [ebx]
movzx edx, byte [esp + 0x3c]
jmp 0x703adfb5
test ebp, ebp
je 0x703ae0b6
mov eax, ebp
shr eax, 0x10
test eax, eax
je 0x703ae09c
mov dword [esp + 4], edx
mov dword [esp + 0x3c], edx
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, 0x703e26c7
test ecx, ecx
mov edx, dword [esp + 0x3c]
jne 0x703ae05f
mov eax, ebp
call fcn.703a9560
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__lx_:_Parsed_fragment__s_len_ld_n
mov dword [esp + 8], str.parse_fragment
mov dword [esp + 4], 0x703d8490
mov dword [esp], 3
call fcn.703a9840
jmp 0x703ae005
mov dword [esp + 4], ebp
mov dword [esp], 0x703e26d1
mov dword [esp + 0x3c], edx
call fcn.703a9200
mov edx, dword [esp + 0x3c]
jmp 0x703ae05f
mov eax, 0x703e26c0
jmp 0x703ae05f
Function at 0x703b96b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x703d8540]
cmp ebx, 0xffffffff
je 0x703b96e0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x703b9720
add esp, 0x18
mov eax, ebx
pop ebx
ret
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov edx, eax
cmp eax, 0xffffffff
je 0x703b9798
mov eax, ebx
lock cmpxchg dword [0x703d8540], edx
mov ebx, eax
cmp dword [0x703d8540], eax
je 0x703b96bf
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
mov ebx, dword [0x703d8540]
sub esp, 4
jmp 0x703b96bf
mov dword [esp + 4], 0x10
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ebx, eax
test eax, eax
je 0x703b96d1
mov dword [esp], 0x703d8520
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [0x703d853c]
lea eax, [ebx + 8]
mov dword [ebx + 8], 0x703d8538
sub esp, 4
mov dword [ebx + 0xc], edx
mov dword [edx], eax
mov dword [0x703d853c], eax
mov dword [esp], 0x703d8520
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [0x703d8540]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, ebx
sub esp, 8
add esp, 0x18
pop ebx
ret
xor ebx, ebx
jmp 0x703b96d1
Function at 0x703b97a0
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
test byte [0x703d8544], 8
jne 0x703b9888
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.703d6c60
sub esp, 0xc
cmp ebx, 1
je 0x703b98c0
cmp ebx, 3
je 0x703b9810
test ebx, ebx
jne 0x703b97f6
test edi, edi
je 0x703b9908
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, dword [0x703d8540]
cmp eax, 0xffffffff
je 0x703b97f6
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x703b97f6
mov dword [esp], 0x703d8520
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
sub esp, 4
mov dword [edx + 4], eax
mov dword [eax], edx
mov dword [esp], 0x703d8520
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx]
sub esp, 4
test eax, eax
je 0x703b9876
test byte [0x703d8544], 4
jne 0x703b99aa
mov dword [esp], eax
call dword [sym.imp.user32.dll_DestroyWindow]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x703b97f6
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._p_0x_lx__p_n
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x703d8544
mov dword [esp], 3
call fcn.703b9180
jmp 0x703b97c9
mov dword [0x703f201c], esi
mov ebx, 0x703e58a0
lea esi, [esi]
nop
mov eax, dword [ebx + 8]
test eax, eax
je 0x703b98f4
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.703a4380
add ebx, 0xc
cmp ebx, 0x703e5924
jne 0x703b98d0
jmp 0x703b97f6
mov dword [esp], 0
call fcn.7039c650
test eax, eax
je 0x703b9924
mov dword [esp], eax
call dword [sym.imp.wininet.dll_InternetCloseHandle]
sub esp, 4
mov eax, dword [0x703f2024]
test eax, eax
je 0x703b9939
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
call fcn.703a5530
mov edx, dword [0x703d8540]
cmp edx, 0xffffffff
je 0x703b9990
mov eax, dword [0x703d8538]
cmp eax, 0x703d8538
je 0x703b9984
mov ebx, dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
nop
mov ecx, dword [eax]
sub eax, 8
mov edx, dword [eax + 0xc]
mov dword [ecx + 4], edx
mov dword [edx], ecx
mov dword [esp], eax
call ebx
mov eax, dword [0x703d8538]
cmp eax, 0x703d8538
jne 0x703b9960
mov edx, dword [0x703d8540]
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_TlsFree]
sub esp, 4
call fcn.7038da80
mov dword [esp], 0x703d8520
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
jmp 0x703b97f6
mov dword [esp + 0xc], str.notif_hwnd_not_destroyed_n
mov dword [esp + 8], str.detach_thread
mov dword [esp + 4], 0x703d8544
mov dword [esp], 2
call fcn.703b9180
mov eax, dword [ebx]
jmp 0x703b986a
Function at 0x703c4ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [sym.imp.rpcrt4.dll_NdrInterfacePointerFree]
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], 0x703e720a
mov eax, dword [ebx + 0x13c]
lea esi, [ebx + 0x58]
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
sub esp, 0xc
mov dword [esp + 8], 0x703e721c
mov eax, dword [ebx + 0x140]
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
sub esp, 0xc
mov dword [esp + 8], 0x703e722e
mov eax, dword [ebx + 0x144]
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
mov eax, dword [ebx + 0x148]
sub esp, 0xc
mov dword [ebx + 0x94], eax
mov dword [esp + 8], 0x703e724a
mov eax, dword [ebx + 0x150]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.rpcrt4.dll_NdrPointerFree]
sub esp, 0xc
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x703c4b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [sym.imp.rpcrt4.dll_NdrInterfacePointerFree]
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], 0x703e724e
mov eax, dword [ebx + 0x13c]
lea esi, [ebx + 0x58]
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
sub esp, 0xc
mov dword [esp + 8], 0x703e7260
mov eax, dword [ebx + 0x140]
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
sub esp, 0xc
mov dword [esp + 8], 0x703e7272
mov eax, dword [ebx + 0x144]
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
mov eax, dword [ebx + 0x148]
sub esp, 0xc
mov dword [ebx + 0x94], eax
mov dword [esp + 8], 0x703e728e
mov eax, dword [ebx + 0x150]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.rpcrt4.dll_NdrPointerFree]
sub esp, 0xc
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x703d7a50
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x220
mov eax, dword [0x703f20e0]
test eax, eax
je 0x703d7af8
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x703d7a88
mov eax, dword [ebx]
add esp, 0x220
pop ebx
pop esi
pop edi
ret
lea edi, [esp + 0x18]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x703d7a79
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x703d7b2d
mov dword [esp + 4], 0x703ede00
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x703f20e0], eax
test eax, eax
jne 0x703d7a6a
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x703d7a7b