joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001018
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x10115c8c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x1000105c
call ebx
test eax, eax
jns 0x10001052
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x10115c88], eax
mov dword [0x10115c8c], 1
mov eax, dword [0x10115c88]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001078
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x100010a8
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x1000109e
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x10001093
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x10001098
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x100010a7
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x1000153f
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x10001590
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x100015a1
push 0xd
pop eax
jmp 0x100015ce
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x100015a4
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x100020e0
Capabilities:
Capture webcam image

Disassembly:
push 0
push dword [esp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x1000268d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push dword [ebp + 8]
xor esi, esi
push dword [edi]
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.100014fe
mov ebx, eax
cmp ebx, esi
je 0x100026d0
lea ecx, [ebp - 8]
call fcn.10001489
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100026eb
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
call fcn.1000268d
cmp eax, esi
jne 0x10002720
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x100
call ebx
test eax, eax
je 0x100026d8
lea ecx, [ebp - 8]
call fcn.10001489
push dword [ebp + 8]
mov ecx, edi
call fcn.1000142e
lea ecx, [ebp - 8]
mov esi, eax
call fcn.10001489
mov eax, esi
jmp 0x100026c9
Function at 0x10004fd5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x100bbda3
call fcn.100a35ac
sub esp, 0x418
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x424], edi
push 2
push edi
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10002c6c
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, edi
jne 0x10005023
call fcn.100013b3
mov esi, eax
jmp 0x1000511a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x10005040
call fcn.100013b3
jmp 0x1000510f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
cmp eax, edi
je 0x10005036
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp + 8], esi
cmp eax, esi
jae 0x1000509c
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x1000507c
lea ecx, [ebp - 0x424]
call fcn.10002097
mov esi, 0x8007000e
lea ecx, [ebp - 0x18]
call fcn.10001fd1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.100034c2
mov dword [ebp - 4], 1
jmp 0x100050c7
cmp dword [ebp - 0x424], edi
jne 0x100050d6
mov esi, 0x8007000e
jmp 0x10005111
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp + 0x10]
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x10005036
mov edx, dword [ebp - 0x424]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x424]
lea ecx, [ebp - 0x20]
call fcn.100045ef
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x10005081
lea ecx, [ebp - 0x424]
call fcn.10002097
jmp 0x10005081
Function at 0x100087d2
Capabilities:
Capture webcam image
Hide graphical window

Disassembly:
mov eax, 0x100bc171
call fcn.100a35ac
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
xor edi, edi
mov ebx, ecx
mov dword [ebp - 4], edi
call fcn.10006e6e
mov ecx, dword [ebx + 0x74]
lea eax, [ebp - 0x11]
push eax
push ebx
mov byte [ebp - 0x11], 0
call fcn.10067b42
cmp byte [ebp - 0x11], 0
mov dword [ebp - 0x18], eax
mov byte [ebp + 0xb], 1
jne 0x10008839
push edi
push dword [ebx + 0x64]
lea eax, [ebx + 0x48]
push ecx
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.10003561
mov ecx, dword [ebx + 0x74]
add ecx, 0xe4
call fcn.10055a11
cmp eax, edi
setne byte [ebp + 0xb]
movzx eax, byte [ebp + 0xb]
neg eax
sbb eax, eax
and eax, 5
push eax
lea esi, [ebx + 0x80]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [ebp + 0xb], 0
jne 0x1000886c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 4
push edi
push edi
push 0xf1
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push 7
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
pop ecx
xor eax, eax
mov dword [ebp - 0x70], 0x20
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0x34]
push eax
mov dword [ebp - 0x6c], 0xa
mov byte [ebp - 0x5f], 0x70
mov dword [ebp + 8], ecx
call fcn.1000357f
lea ecx, [ebp - 0x70]
push ecx
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0xc]
push eax
mov edi, 0x440
push edi
push dword [ebp - 0x18]
call esi
mov eax, dword [ebx + 0xc]
push 0
push eax
push 0x419
push dword [ebp - 0x18]
call esi
lea ecx, [ebp - 0x50]
push ecx
push eax
push 0x41d
push dword [ebp - 0x18]
call esi
cmp byte [ebp - 0x11], 0
jne 0x1000890f
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x70]
push ecx
mov word [ebp - 0x5e], ax
mov eax, dword [ebx + 0xc]
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x6c], 0x48
mov byte [ebp - 0x5f], 0x60
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x100cb0a0
call fcn.10005f07
push 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Height
mov byte [ebp - 4], 1
call fcn.10005f07
mov byte [ebp - 4], 0
call fcn.100400d9
sub eax, dword [ebp - 0x44]
add esp, 0xc
add eax, dword [ebp - 0x4c]
cdq
sub eax, edx
sar eax, 1
push eax
push 0
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
add dword [ebp - 0x50], 2
push 1
lea eax, [ebp - 0x50]
lea edi, [ebx + 0x80]
push eax
mov ecx, edi
call fcn.10001df6
mov eax, dword [ebx + 0x74]
mov eax, dword [eax + 0xbc]
push 1
push eax
push 0x30
push dword [edi]
call esi
cmp byte [0x10115f52], 0
jne 0x10008998
mov ecx, dword [ebp + 8]
push 0
call fcn.1000357f
push eax
jmp 0x1000899d
push 0x100cb0a0
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x10008859
Function at 0x1000d5e3
Capabilities:
Parse url

Disassembly:
mov eax, 0x100bc550
call fcn.100a35ac
sub esp, 0x3c
push ebx
push edi
mov ebx, ecx
xor edi, edi
push 0x38
lea eax, [ebp - 0x44]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.100a2490
push 0x200
mov dword [ebp - 0x48], 0x3c
call fcn.100a1cc0
push 0x100
push edi
push eax
mov dword [ebp - 0x38], eax
call fcn.100a2490
push 0x1000
mov dword [ebp - 0x34], 0x100
call fcn.100a1cc0
push 0x800
push edi
push eax
mov dword [ebp - 0x1c], eax
call fcn.100a2490
mov eax, dword [ebp + 0xc]
add esp, 0x2c
cmp dword [ebp + 0x20], 8
mov dword [ebp - 0x18], 0x7ff
jae 0x1000d65b
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x48]
push ecx
push edi
push dword [ebp + 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
push dword [ebp - 0x38]
mov ecx, ebx
call fcn.10005a39
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x1c]
call fcn.10005a39
push dword [ebp - 0x38]
call fcn.100a2009
push dword [ebp - 0x1c]
call fcn.100a2009
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp + 8]
call fcn.100035a9
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c

Function at 0x1000dcb2
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov eax, 0x100bc650
call fcn.100a35ac
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
add ecx, 0x50
mov dword [ebp - 4], edi
call fcn.1000357f
push 0x24
push str.Alert
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x1000dcfd
mov eax, 0xfffffe6f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push 0x7a
mov esi, 0x1000
xor ebx, ebx
pop eax
test eax, eax
je 0x1000dd44
cmp eax, 0x7a
jne 0x1000dd7a
test edi, edi
je 0x1000dd1b
push edi
call fcn.100a2c09
pop ecx
push esi
call fcn.100a1cc0
mov edi, eax
pop ecx
lea eax, [ebp - 0x14]
push eax
mov dword [edi], esi
mov dword [ebp - 0x14], esi
push edi
test ebx, ebx
jne 0x1000dd5e
push ebx
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x1000dd65
test dword [edi + 0xc], 0x100000
jne 0x1000dd56
push dword [edi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
push edi
push ebx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x1000dd6d
xor eax, eax
jmp 0x1000dd76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x14]
xor ecx, ecx
je 0x1000dd07
push edi
call fcn.100a2c09
pop ecx
test ebx, ebx
je 0x1000dd8c
push ebx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
xor eax, eax
jmp 0x1000dcec
Function at 0x1000e10c
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov eax, 0x100bc6d0
call fcn.100a35ac
sub esp, 0x2c
push ebx
push esi
add ecx, 0x50
mov eax, dword [ecx]
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], edi
cmp dword [eax - 0xc], edi
je 0x1000e152
push edi
call fcn.1000357f
push 0x24
push str.Alert
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x1000e152
mov eax, 0xfffffe6f
jmp 0x1000e271
push 0x7a
mov esi, 0x1000
xor ebx, ebx
pop eax
test eax, eax
je 0x1000e223
cmp eax, 0x7a
jne 0x1000e25d
push edi
call fcn.100a2c09
push esi
call fcn.100a1cc0
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 0x14]
push eax
mov dword [edi], esi
mov dword [ebp - 0x14], esi
push edi
test ebx, ebx
jne 0x1000e23d
push ebx
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x1000e244
test dword [edi + 0xc], 0x100000
je 0x1000e235
push dword [edi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
push edi
push ebx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x1000e24c
xor eax, eax
jmp 0x1000e255
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x14]
xor ecx, ecx
je 0x1000e15c
push edi
call fcn.100a2c09
pop ecx
test ebx, ebx
je 0x1000e26f
push ebx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x100101a0
Capabilities:
Check if file exists
Copy file

Disassembly:
mov eax, 0x100bca75
call fcn.100a35ac
sub esp, 0x238
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov esi, ecx
push edi
push str.temp
lea ecx, [esi + 0x68]
mov dword [ebp - 4], edi
call fcn.10003080
cmp eax, 0xffffffff
jle 0x100102c3
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.100404f4
pop ecx
pop ecx
add esi, 0x7c
push esi
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
call fcn.10005363
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.10001d29
lea eax, [ebp - 0x18]
push eax
call fcn.100406df
pop ecx
push esi
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call fcn.10005363
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 6
call fcn.10001d29
xor eax, eax
push 0x206
mov word [ebp - 0x244], ax
lea eax, [ebp - 0x242]
push edi
push eax
call fcn.100a2490
push dword [ebp - 0x14]
lea eax, [ebp - 0x244]
push eax
call fcn.100a56ba
add esp, 0x14
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10010292
push ecx
lea eax, [ebp - 0x244]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.10005f07
call fcn.10024c36
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100102ad
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x10010364
Capabilities:
Check if file exists
Copy file

Disassembly:
mov eax, 0x100bcaaf
call fcn.100a35ac
sub esp, 0x38
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0
push eax
mov esi, ecx
call fcn.100404f4
pop ecx
pop ecx
lea edi, [esi + 0x7c]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.10005363
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.10001d29
lea eax, [ebp - 0x20]
push eax
call fcn.100406df
pop ecx
push edi
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call fcn.10005363
add esp, 0xc
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 6
call fcn.10001d29
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100103f4
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x14]
lea ecx, [esi + 0x64]
push eax
call fcn.10004a20
lea ecx, [esi + 0x50]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x10010415
push str.false
call fcn.10004da9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.1000e81e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10001d29
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x10010ab8
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov eax, 0x100bcb7b
call fcn.100a35ac
sub esp, 0x38
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x5c]
mov eax, dword [ecx]
xor esi, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
cmp dword [eax - 0xc], esi
je 0x10010b0c
push esi
call fcn.1000357f
push 0x34
push str.Alert
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x10010b0c
mov eax, 0xfffffe6f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.100404f4
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1000357f
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x18]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
mov byte [ebp - 4], 0
call fcn.10001d29
test bl, bl
je 0x10010bc2
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x100cb0a0
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Error
mov byte [ebp - 4], 2
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.ErrorMsg
mov byte [ebp - 4], 3
call fcn.10005f07
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0
call fcn.1003fd77
add esp, 0x10
push esi
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1000357f
push esi
lea ecx, [edi + 0x58]
mov ebx, eax
call fcn.1000357f
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001d29
push 0xfffffffffffffffb
pop eax
jmp 0x10010afb
push dword [edi + 0x54]
call fcn.1009e73f
mov ebx, dword [ebp + 8]
pop ecx
push 0xfde9
push 1
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0xbc]
push dword [ebp - 0x14]
call fcn.100a26e2
pop ecx
cmp eax, 0x1000
jbe 0x10010c02
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov word [ecx + 0x2000], ax
push esi
lea ecx, [edi + 0x50]
call fcn.1000357f
push 1
push esi
push dword [ebp - 0x14]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x14]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xa8]
xor eax, eax
jmp 0x10010afb
Function at 0x100119a4
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x100bcd36
call fcn.100a35ac
sub esp, 0xc0
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push eax
call fcn.10064264
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100119fb
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 8
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10011a0a
lea ebx, [eax + 0xb8]
jmp 0x10011a0c
xor ebx, ebx
push 0
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
lea edi, [esi + 0x50]
push edi
call fcn.10003561
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.1000dad3
add esp, 0x10
mov byte [ebp - 4], 2
call fcn.1005528b
push esi
push ecx
mov byte [eax], 0
lea eax, [esi + 0x58]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.10003561
push dword [esi + 0x5c]
lea eax, [esi + 0x54]
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 4
call fcn.10003561
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push edi
mov byte [ebp - 4], 5
call fcn.10003561
push dword [esi + 0x44]
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 3
call fcn.1008bcca
mov eax, dword [esi + 0x44]
lea ecx, [eax + 0xb8]
mov eax, dword [ecx]
mov byte [ebp - 4], 6
call dword [eax + 0x5c]
push 0
push eax
lea ecx, [ebp - 0xcc]
call fcn.1000d081
cmp eax, 1
jne 0x10011ac6
lea ecx, [ebp - 0xcc]
call fcn.1008b2ca
test al, al
jne 0x10011ac6
call fcn.1005528b
mov byte [eax], 1
mov ecx, dword [esi + 0x44]
call fcn.1006448c
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 3
call fcn.1008bf4a
mov dword [ebp - 4], 2
call fcn.1005528b
mov byte [eax], 1
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.10001d29
jmp 0x100119dd
Function at 0x1001235c
Capabilities:
Create thread

Disassembly:
mov eax, 0x100bce5a
call fcn.100a35ac
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ebx
call fcn.10001a60
push str.AfterInit
push dword [ebp + 8]
call fcn.100a26ab
pop ecx
pop ecx
test eax, eax
je 0x100123ac
push str.AfterReInit
push dword [ebp + 8]
call fcn.100a26ab
pop ecx
pop ecx
test eax, eax
jne 0x1001248c
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
mov edi, 0x100cc7ac
push edi
call fcn.10005f07
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
mov esi, str.fb_firstrun
push esi
mov byte [ebp - 4], 1
call fcn.10005f07
mov byte [ebp - 4], 0
call fcn.100400d9
add esp, 0xc
cmp eax, ebx
jne 0x1001248c
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push edi
call fcn.10005f07
push 1
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push esi
mov byte [ebp - 4], 2
call fcn.10005f07
mov byte [ebp - 4], 0
call fcn.100402b5
add esp, 0xc
push 0x20
call fcn.100a2ba4
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x1001242d
call fcn.1000cf82
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x54]
mov byte [ebp - 4], 0
test edi, edi
je 0x1001244a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1001244e
xor eax, eax
jmp 0x10012467
lea esi, [eax + eax]
mov eax, esi
call fcn.100a58a0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.1000c578
push eax
mov ecx, ebx
call fcn.10005569
lea ecx, [ebx + 0x1c]
push str.www.freecause.com
call fcn.10004da9
push ebx
push 0
push 0x100120d7
call fcn.100a57da
add esp, 0xc
xor eax, eax
lea esp, [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1001353c
Capabilities:
Get geographical location

Disassembly:
push esi
push 0
mov esi, ecx
push 1
lea eax, [esi + 0x60]
push eax
push str.LANGUAGE
push dword [esp + 0x18]
call fcn.10013514
push 0
push 1
add esi, 0x78
push esi
push str.COUNTRY
push dword [esp + 0x2c]
call fcn.10013514
add esp, 0x28
pop esi
ret 4
Function at 0x10013d0f
Capabilities:
Parse url

Disassembly:
mov eax, 0x100bd006
call fcn.100a35ac
sub esp, 0x40
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.DataPoster.0
call fcn.1000ce4c
lea ebx, [esi + 0x20]
mov ecx, ebx
call fcn.1000ce4c
lea ecx, [esi + 0x3c]
call fcn.1000ce4c
lea ecx, [esi + 0x58]
call fcn.1000ce4c
lea edi, [esi + 0x74]
mov ecx, edi
call fcn.1000ce4c
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.10004bfe
push 0x38
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.100a2490
mov edi, 0x100
push edi
mov dword [ebp - 0x4c], 0x3c
call fcn.100a1cc0
push edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edi
call fcn.100a1cc0
add esp, 0x14
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edi
jae 0x10013dad
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x4c]
push ecx
push 0
push dword [ebp + 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
push dword [ebp - 0x3c]
mov ecx, ebx
call fcn.10005569
push dword [ebp - 0x20]
lea ecx, [esi + 0x3c]
call fcn.10005569
movzx eax, word [ebp - 0x34]
push dword [ebp - 0x3c]
mov dword [esi + 0x90], eax
call fcn.100a2009
push dword [ebp - 0x20]
call fcn.100a2009
pop ecx
pop ecx
push str.1BEF0A57BE110FD467A
lea ecx, [esi + 0x58]
call fcn.10005569
push 0
push 1
lea ecx, [ebp + 8]
call fcn.10003516
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c