joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020d8c
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x1003cde0], 0
push ebx
push esi
push edi
mov esi, 0x1003d210
je 0x10020dba
push str.PDFXTerm
push esi
call fcn.1001f9a5
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10020dba
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [0x1003d610]
xor ecx, ecx
xor ebx, ebx
inc ecx
test eax, eax
je 0x10020ea4
jmp 0x10020e5b
mov edi, dword [eax]
cmp word [edi + 0x2c], bx
jne 0x10020e1c
mov word [edi + 0x2c], cx
cmp byte [0x1003cde0], bl
je 0x10020e03
push edi
push str.PDFX_0x_xl_.closing__true
push esi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], bl
je 0x10020e03
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [0x1003d610]
push 2
push dword [edi + 8]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
call esi
pop ecx
pop ecx
push edi
mov dword [edi + 8], ebx
call fcn.1001f9a5
mov eax, dword [0x1003d610]
mov ecx, dword [edi]
push 4
push ebx
push edi
mov dword [eax], ecx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1003d610]
add esp, 0x10
mov esi, dword [eax + 0x28]
mov ecx, esi
push edi
call dword [0x1002e5c4]
call esi
mov eax, dword [0x1003d610]
mov esi, 0x1003d210
pop ecx
push 1
pop ecx
cmp dword [eax], ebx
jne 0x10020dd1
mov ecx, dword [eax + 0x44]
test ecx, ecx
je 0x10020e76
push ecx
call fcn.1001f9a5
mov eax, dword [0x1003d610]
pop ecx
push 4
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1003d610]
add esp, 0xc
mov esi, dword [eax + 0x28]
mov ecx, esi
push eax
call dword [0x1002e5c4]
call esi
pop ecx
xor ecx, ecx
mov dword [0x1003d610], ebx
mov esi, 0x1003d210
inc ecx
mov eax, dword [0x1003d614]
test eax, eax
je 0x10020f81
jmp 0x10020f40
mov edi, dword [eax]
cmp word [edi + 0x2c], bx
jne 0x10020f01
mov word [edi + 0x2c], cx
cmp byte [0x1003cde0], bl
je 0x10020ee8
push edi
push str.PDFX_0x_xl_.closing__true
push esi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], bl
je 0x10020ee8
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [0x1003d614]
push 2
push dword [edi + 8]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
call esi
pop ecx
pop ecx
push edi
mov dword [edi + 8], ebx
call fcn.1001f9a5
mov eax, dword [0x1003d614]
mov ecx, dword [edi]
push 4
push ebx
push edi
mov dword [eax], ecx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1003d614]
add esp, 0x10
mov esi, dword [eax + 0x28]
mov ecx, esi
push edi
call dword [0x1002e5c4]
call esi
mov eax, dword [0x1003d614]
mov esi, 0x1003d210
pop ecx
push 1
pop ecx
cmp dword [eax], ebx
jne 0x10020eb6
mov ecx, dword [eax + 0x44]
test ecx, ecx
je 0x10020f5b
push ecx
call fcn.1001f9a5
mov eax, dword [0x1003d614]
pop ecx
push 4
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1003d614]
add esp, 0xc
mov esi, dword [eax + 0x28]
mov ecx, esi
push eax
call dword [0x1002e5c4]
call esi
pop ecx
mov dword [0x1003d614], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10021ace
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x440
mov eax, 0x1002ccbc
call fcn.1002a16a
mov eax, dword [ebp + 8]
mov esi, 0x208
mov dword [ebp - 0x438], eax
xor edi, edi
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x424]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x434], 0x104
lea eax, [ebp - 0x428]
xorps xmm0, xmm0
movsd qword [ebp - 0x430], xmm0
push eax
push 0x20019
push edi
push 0x1003233c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10021ced
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
mov ebx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
jmp 0x10021bda
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
fstp qword [ebp - 0x44c]
movsd xmm0, qword [ebp - 0x44c]
comisd xmm0, xmmword [0x100325c8]
pop ecx
jbe 0x10021bc6
comisd xmm0, xmmword [ebp - 0x430]
jbe 0x10021bc6
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x430], xmm0
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
inc ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x10021b72
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x10021ced
push str.ClientUserInterface
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov dword [esp], str.SoftwareMicrosoftSoftGrid_
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor ecx, ecx
mov dword [ebp - 0x42c], edi
push 2
pop edx
lea ebx, [eax + 0x105]
mov dword [ebp - 4], edi
add ebx, esi
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f9a5
mov esi, eax
mov dword [ebp - 0x42c], esi
pop ecx
pop ecx
test esi, esi
je 0x10021ced
push ebx
push edi
push esi
call fcn.1001f9a5
push str.SoftwareMicrosoftSoftGrid_
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push str.ClientUserInterface
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x30
lea eax, [ebp - 0x428]
push eax
push 0x20019
push edi
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10021ce6
push dword [ebp - 0x438]
push str.LaunchCommand
push dword [ebp - 0x428]
call fcn.10021d20
add esp, 0xc
push dword [ebp - 0x43c]
push str.DDELaunchCommand
push dword [ebp - 0x428]
call fcn.10021d20
add esp, 0xc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1002a647
pop ecx
call fcn.1002a0b7
ret
Function at 0x10021d20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002cce4
call fcn.1002a133
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e65
cmp dword [ebp - 0x18], 1
jne 0x10021e65
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f9a5
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x10021e65
push dword [ebp - 0x14]
push ebx
push esi
call fcn.1001f9a5
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e5a
cmp dword [ebp - 0x18], 1
jne 0x10021e5a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f9a5
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10021e5a
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.1001f9a5
lea eax, [ebp - 0x20]
push eax
push 0x10032338
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10021e3e
push ebx
call fcn.1001f9a5
pop ecx
test al, al
je 0x10021e3e
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10021e5a
push dword [edi]
call fcn.1002a647
and dword [edi], 0
pop ecx
jmp 0x10021e5a
test esi, esi
je 0x10021e65
push esi
call fcn.1002a647
pop ecx
call fcn.1002a091
ret

Function at 0x100225b9
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10032094
xor esi, esi
call fcn.1001f9a5
pop ecx
test eax, eax
jne 0x100225da
push 0x100320ac
call fcn.1001f9a5
pop ecx
test eax, eax
je 0x100225dd
xor esi, esi
inc esi
cmp byte [0x1003cde0], 0
je 0x1002260c
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d628
push edi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002260b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100246d8
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cde0], 0
je 0x10024738
movzx eax, bl
mov esi, 0x1003e190
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10024738
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cde0], 0
je 0x10024768
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e190
push esi
call fcn.1001f9a5
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10024768
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, 1
pop esi
ret
Function at 0x10025de4
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x1002ce82
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003e190
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xad0], eax
je 0x10025e33
push str._ACTWinBrowser__SendAcroIPCMessage
push ebx
call fcn.1001f9a5
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025e33
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10025dc7
mov eax, dword [ebp - 0xacc]
lea edi, [ebp - 0xac8]
test eax, eax
cmovne edi, eax
test esi, esi
je 0x1002602b
cmp dword [esi + 0x400], ebx
jne 0x10025e8a
push ebx
push ebx
push ebx
push ebx
call fcn.10022610
add esp, 0x10
test eax, eax
je 0x1002602b
push dword [esi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1001f9a5
add esp, 0x18
test eax, eax
jle 0x1002602b
lea ecx, [ebp - 0x6bc]
call fcn.10025da7
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.1001f9a5
add esp, 0x18
test eax, eax
jne 0x10026002
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10029305
push dword [esi + 0x400]
lea eax, [ebp - 0x6bc]
mov dword [ebp - 4], ebx
push 0x1388
push edi
push eax
lea ecx, [ebp - 0x2ac]
call fcn.1002952a
test eax, eax
jne 0x10025f6a
cmp dword [edi + 4], eax
sete bl
cmp byte [0x1003cde0], al
je 0x10025ff5
push dword [edi + 4]
mov esi, 0x1003e190
push str._ACTWinBrowser__SendAcroIPCMessage_IPC_call_success_status___lu
push esi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025ff5
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10025ff5
cmp byte [0x1003cde0], 0
mov esi, 0x1003e190
je 0x10025f95
push str.IPC_Error:_AIPC_ERR
push esi
call fcn.1001f9a5
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025f95
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xacc], ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageA]
cmp byte [0x1003cde0], 0
je 0x10025fe9
push dword [ebp - 0xacc]
push str._ACTWinBrowser__IPC_Error_:__s
push esi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025fe9
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0xacc]
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2ac]
call fcn.1001f9a5
jmp 0x1002602b
cmp byte [0x1003cde0], bl
je 0x1002602b
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x1003e190
push esi
call fcn.1001f9a5
pop ecx
pop ecx
cmp byte [0x1003cde0], bl
je 0x1002602b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.1002a0a6
ret
Function at 0x100277eb
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10027808
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278ec
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5e0
push edi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_void____d
push edi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1002795e
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002cf70
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov edi, dword [ebp + 8]
je 0x1002799d
lea eax, [edi + 4]
mov esi, 0x1003e5e0
push eax
push str.ASM_Release__s
push esi
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002799d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100279d3
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.1001f9a5
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002a0a6
ret
Function at 0x100279e9
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002cf9d
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
je 0x10027a48
call fcn.1001f9a5
test al, al
mov edx, 0x1002ea51
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5e0
call fcn.1001f9a5
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10027a48
push 0x1003e5e0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.1001f9a5
test ebx, ebx
jne 0x10027aae
cmp byte [0x1003cde0], bl
je 0x10027b0f
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5e0
push ebx
call fcn.1001f9a5
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10027b0f
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10027b0f
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10027ad5
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10027a8f
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10027aff
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10027a8f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002a0a6
ret
Function at 0x100034f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x1001df2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x234]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x22c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x10003568
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
je 0x10003558
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x1000357a
jmp 0x1000356c
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x10003615
push ecx
jmp 0x1000360f
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x100035e0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.100034f0
mov ebx, eax
cmp ebx, edi
jne 0x10003631
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x100035a2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x100035f3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x234]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x10003615
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x10003640
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x10003617
Function at 0x10003aa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2008
call fcn.10015fe0
push esi
push 0
push 0
mov esi, dword [esp + 0x2018]
push 0
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x10003aea
xor eax, eax
pop esi
add esp, 0x2008
ret 4
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x10003b30
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push esi
mov dword [esp + 0x28], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10003ade
cmp word [esp + 0xc], ax
je 0x10003ade
mov eax, 1
pop esi
add esp, 0x2008
ret 4
xor ecx, ecx
pop esi
cmp ecx, eax
sbb eax, eax
neg eax
add esp, 0x2008
ret 4

Function at 0x100043a0
Capabilities:
Check http status code
Create http request

Disassembly:
sub esp, 8
push esi
push edi
push 0
push 0
push 0
push 4
mov edi, ecx
push str.Mozilla_4.0__compatible_
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x1000444c
push 0
push 0x4000000
push 0
push 0
push edi
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x1000443f
lea eax, [esp + 0xc]
push 0
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x20000013
push edi
mov dword [esp + 0x20], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000442b
mov eax, dword [esp + 8]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, 0x193
jne 0x10004447
call edi
push esi
call edi
mov eax, 1
pop edi
pop esi
add esp, 8
ret
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
xor eax, eax
pop edi
pop esi
add esp, 8
ret
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x10004670
Capabilities:
Encode data using xor
Get common file path
Read file on windows

Disassembly:
sub esp, 0x188
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x94]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x94]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
mov ecx, ebp
push 3
push eax
and ecx, 3
push 3
lea eax, [esp + 0xa8]
push SysReAllocStringLen
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000477e
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push 0x80
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000477e
xor eax, eax
mov cl, byte [esp + eax + 0x14]
xor cl, 0xea
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x80
jb 0x10004724
mov ecx, 8
lea esi, [esp + 0x14]
mov edi, ebx
mov eax, 1
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov ecx, 8
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x40]
mov ecx, 8
lea esi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x60]
mov ecx, 8
lea esi, [esp + 0x74]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x188
ret
Function at 0x10008620
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1001e1f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 8], 0
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
push esi
mov eax, dword [esi]
mov byte [esp + 0x20], 1
call dword [eax + 0x30]
mov edx, dword [esi]
lea eax, [esp + 8]
push eax
push esi
call dword [edx + 0x50]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push str.Select
push ecx
push edx
mov ecx, edi
call fcn.10004a20
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100086f4
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
jbe 0x100086f4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100086b0
push eax
call esi
cmp eax, 0x200
jae 0x100086f4
mov eax, dword [esp + 8]
test eax, eax
je 0x100086f4
push eax
call esi
test eax, eax
jbe 0x100086f4
mov eax, dword [esp + 8]
test eax, eax
je 0x100086d1
push eax
call esi
cmp eax, 0x200
jae 0x100086f4
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esi + 0x400]
push ecx
call fcn.10016b1b
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.10016b1b
add esp, 0x10
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8